CVE-2026-57198
Description
A flaw was found in Asterisk. In deployments where the chan_sip channel driver has text support enabled, an authenticated attacker can send specially crafted network packets to trigger a heap-based buffer overflow in the T.140 Redundant Data (RED) handling mechanism. This vulnerability could allow the attacker to achieve arbitrary code execution or trigger an application crash, resulting in a Denial of Service (DoS).
Statement
Red Hat has rated this vulnerability as Important severity because an authenticated remote attacker can potentially execute arbitrary code or trigger a service crash by corrupting heap memory. However, successful exploitation requires non-default prerequisites: the legacy chan_sip module must be actively configured and real-time text support (textsupport) explicitly turned on, which is disabled by default. Systems using default configurations or utilizing the modern chan_pjsip channel driver are not vulnerable.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce bounds checking on T.140 frame lengths within res_rtp_asterisk to prevent unsigned char integer wrap and heap buffer overruns in RTP RED buffers: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 (or the fixed Asterisk builds), which truncate primary T.140 payloads exceeding 255 bytes, flush pending buffered frames when space is insufficient, and discard frames exceeding 255 bytes, closing all 2 injection vectors (oversized incoming T.140 RED data packets exceeding 255 bytes, oversized outgoing T.140 text frames exceeding 255 bytes). Until patched, this is only a concern on Asterisk deployments with the legacy chan_sip channel driver configured and textsupport explicitly enabled — Deployments with textsupport disabled by default or running chan_pjsip are unaffected — so Disable textsupport in chan_sip configurations, migrate to the chan_pjsip channel driver, or restrict authenticated SIP session initiation privileges to trusted users. As a compensating measure, Enable Address Space Layout Randomization to randomize Asterisk process memory layout and hinder reliable code execution, Enable Full RELRO and Position Independent Executables to protect global offset tables and randomize binary code offsets, and Enable Control Flow Integrity or Shadow Call Stack to validate indirect call targets and branch destinations against ROP or JOP execution chains. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wrap and heap buffer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
