CVE-2026-57184
Description
A flaw was found in Asterisk. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending specially crafted setup packets to the chan_ooh323 channel driver. Due to insufficient bounds checking in the Q.931 protocol parser, processing these malformed packets triggers an out-of-bounds read that crashes the service. This flaw only affects environments where the optional chan_ooh323 module is compiled, installed, and reachable over the network.
Statement
This vulnerability is rated with an Important severity because an unauthenticated remote attacker can trigger an unexpected termination of the telephony daemon, resulting in a complete denial of service. The impact is elevated due to the lack of required authentication or user interaction to crash the process. However, exposure across typical deployments is minimal because the affected H.323 channel module is an optional component that is not built or enabled by default. Systems remain unaffected unless administrators have manually compiled, configured, and exposed this specific channel driver to untrusted network traffic.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate buffer bounds before decoding Q.931 information element length fields and discriminators in the chan_ooh323 parser: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, Cert 20.7-cert11, 22.8-cert3 (or the fixed Asterisk builds), which enforce bounds checks against the buffer length before reading information element length and discriminator bytes, returning Q931_E_INVLENGTH if an overrun occurs, closing all 2 injection vectors (crafted Q.931 setup packets, truncated Q.931 information element payloads). Until patched, this is a concern on Deployments with the optional chan_ooh323 channel driver compiled, installed, and exposed to network traffic, so Block untrusted network access to the chan_ooh323 port with firewall rules or unload and disable the optional chan_ooh323 channel module. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds read defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
