Evidence-led vulnerability intelligence · 2026-10-27 01:47 IST

CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

HIGH · 7.1

Executive briefing

The source record describes: Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. The practical risk depends on whether an affected product/version is present, reachable and configured in an exploitable way. Review the affected-product evidence and linked vendor advisories before assigning exposure status.

Assessment: Potential exposure only — validate the installed product, exact version, configuration and vendor applicability before treating an asset as confirmed vulnerable.

Evidence confidence: Limited Evidence-derived, not an exploitability verdict

Severity & attack characteristics

7.1 / 10 · 4.0

CVSS vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vectorN

Attack complexityL

Attack requirementsN

Privileges requiredL

User interactionN

ScopeX

Technical explanation & impact

The technical mechanism is not expanded beyond the source description unless a referenced advisory supplies additional evidence. Read the linked vendor/CERT advisories for root-cause detail.

Potential impact must be interpreted from the published CVSS impact metrics and the affected component. A CVSS impact score is not proof that a particular asset is exploitable.

Weakness classification

CWE-416CWE-664

Affected products and versions

NVD has not supplied machine-readable vulnerable CPE product/version entries for this CVE. This is an information gap, not proof that no products are affected. Check the vendor advisory references below.

Remediation & validation

Identify exposure by comparing the affected product and version ranges with your asset inventory, SBOM and externally exposed services.
Review the linked vendor security advisory or patch notes. Upgrade to a vendor-confirmed fixed release; do not infer a fixed version from the CVE description.
Until patched, consider restricting network access or disabling the affected feature where operationally safe. These are temporary controls, not a substitute for a vendor fix.
Validate the remediation with a version check and vulnerability rescan, then retain change evidence.

No fixed version is displayed unless it is explicitly established by a vendor advisory. Follow the vendor's release notes for exact product and branch applicability.

Vendor advisories, patches & exploit references

https://github.com/asterisk/asterisk/commit/0f076168e0be31ebee37762192d0ee049e9c0d42 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/6e1f4df744369d66ea6f412e355d819b2a7bf26c VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/9e0386c6d259f0c7499d52499d9891bee8a494fa VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/b7ba85458796ef54b471017287c7806095dbda76 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/d4e30005940f86942745bcc64f34748d69870247 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/commit/f1e47621472bb3d8ad71f32823f5ca986e008437 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/20.20.1 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/21.12.3 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/22.10.1 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/23.4.1 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6 VENDOR security-advisories@github.com
https://github.com/asterisk/asterisk/tree/24.0.0-pre1 VENDOR security-advisories@github.com

Information gaps & confidence notes

These gaps indicate missing source data. CVE Watch does not fill them with guessed product, exploit or patch details.

NVD does not currently provide machine-readable vulnerable CPE product/version entries for this record.

Last enrichment: 2026-11-03T19:02:50+00:00 · Source last modified: 2026-11-02T19:18:07.450

Open NVD record ← Back to CVE Watch