CVE-2026-57189
Description
A flaw was found in Asterisk. In configurations where the chan_sip channel driver has text support enabled, an authenticated remote attacker can send specially crafted packets during real-time text processing to trigger an out-of-bounds memory write. This vulnerability may allow the attacker to achieve arbitrary code execution or crash the Asterisk service, leading to a denial of service (DoS).
Statement
Important: This flaw is rated as Important rather than Moderate because an authenticated remote attacker can trigger an out-of-bounds write that may lead to arbitrary code execution or daemon termination. Exploitation is constrained by requiring valid credentials and a non-standard configuration where real-time text handling is explicitly enabled on the legacy chan_sip channel driver. Because text support is disabled by default in standard installations, systems operating with default settings are not vulnerable. Furthermore, Asterisk is not included in Red Hat Enterprise Linux, limiting the overall impact on supported Red Hat platforms.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable chan_sip textsupport or bound T.140 frame length attributes before RTP buffer assignment: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 (or the fixed Asterisk builds), which truncate primary payloads exceeding 255 bytes to UCHAR_MAX, flush buffered frames when capacity is exceeded, and discard frames larger than 255 bytes, closing all 2 injection vectors (crafted T.140 RED packets exceeding 255 bytes, generation accumulation frame buffering overflow). Until patched, this is only a concern on Asterisk deployments configuring chan_sip with textsupport enabled — deployments with default configuration where textsupport is disabled or chan_sip is not installed are unaffected — so disable textsupport in chan_sip channel driver configuration and restrict remote authentication access. As a compensating measure, enable ASLR to randomize userspace memory layout and prevent predictable code execution targets, compile with Full RELRO and PIE to protect binary memory structures and function pointers from overwrite, enforce Control Flow Integrity or Shadow Call Stack to restrict redirection of indirect call targets, and enable compiler integer overflow and conversion checks to trap unsigned char wrapping on large frame lengths. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wrapping out-of-bounds memory write — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
