Stack-based buffer overflow in Asterisk Open Source and Certified Asterisk - CVE-2026-57191
Published: June 26, 2026
Vulnerability identifier: #VU135538
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-57191
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in Message-Account parsing in res_pjsip_pubsub when handling a crafted MWI NOTIFY packet. A remote attacker can send a carefully crafted packet to cause a denial of service.
The issue can corrupt the underlying transport and permanently disable SIP functionality until the service is restarted.
Affected software
Asterisk Open Source
Certified Asterisk
Certified Asterisk
How to mitigate CVE-2026-57191
Install security update from vendor's website.
Asterisk Open Source - addressed in versions 20.20.1, 21.12.3, 22.10.1, 23.4.1
Certified Asterisk - addressed in versions 20.7-cert11, 22.8-cert3
Certified Asterisk - addressed in versions 20.7-cert11, 22.8-cert3