CVE-2026-57201
Description
A flaw was found in Asterisk. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted network packet to an Asterisk instance with the H.323 channel driver enabled. The trace-logging function fails to bound the input size when writing to an internal buffer, resulting in a stack buffer overflow that crashes the Asterisk process.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can trigger an immediate denial of service by crashing the daemon over the network without requiring privileges. Asterisk is not included or supported in any Red Hat Enterprise Linux release or Red Hat product offering. In addition, triggering the condition requires the non-default chan_ooh323 addon driver to be manually compiled, configured, and directly exposed to untrusted network traffic.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unbounded vsprintf formatting into fixed stack buffers within the Asterisk ooh323 trace logging subsystem: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 (or the fixed Asterisk builds), which replace fixed-size stack buffer and vsprintf with dynamic string allocation via ast_vasprintf and error checking, closing crafted H.323 network packets. Until patched, this is a concern on Asterisk deployments with the chan_ooh323 channel driver compiled, loaded, and exposed with trace logging enabled, so Disable H.323 trace logging, unload or do not compile the chan_ooh323 module, and restrict network accessibility to the H.323 channel driver port from untrusted networks. These controls limit blast radius and contain exploitation, but they do not fix the underlying stack buffer overflow defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
