{"id":"CVE-2026-57189","kind":"vulnerability","aliases":["CVE-2026-57189"],"related":[],"title":"Asterisk: T.140 RED out-of-bounds write via chan_sip text support","description":"Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.","summary":"An authenticated attacker can send crafted packets that cause an out-of-bounds write in Asterisk's T.140 RED text handling during generation accumulation. The write can lead to remote code execution or crash Asterisk.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","package","pbx","sip","voip"],"not_affected_if":["chan-sip-not-loaded","pjsip-only","textsupport-disabled"],"how_to_check":"- Run `asterisk -rx \"module show like chan_sip\"` to see whether chan_sip is loaded\n- Check sip.conf for `textsupport=yes` in the relevant peer or general section (default is no)\n- Confirm the installed release against the fixed versions listed in the fix","fix":"- Upgrade Asterisk 20 to `20.20.1` or later, Asterisk 21 to `21.12.3`, Asterisk 22 to `22.10.1`, Asterisk 23 to `23.4.1`\n- Certified Asterisk: move to `20.7-cert11` or `22.8-cert3`\n- If chan_sip is not needed, leave `textsupport` at no or stop loading chan_sip","status":"open","published_at":"2026-10-27T17:17:01+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:35:05+00:00","updated_at":"2026-10-27T17:35:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T17:35:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk 20 to `20.20.1` or later, Asterisk 21 to `21.12.3`, Asterisk 22 to `22.10.1`, Asterisk 23 to `23.4.1`\n- Certified Asterisk: move to `20.7-cert11` or `22.8-cert3`\n- If chan_sip is not needed, leave `textsupport` at no or stop loading chan_sip","reach":"network","title":"Asterisk: T.140 RED out-of-bounds write via chan_sip text support","impact":"high","summary":"An authenticated attacker can send crafted packets that cause an out-of-bounds write in Asterisk's T.140 RED text handling during generation accumulation. The write can lead to remote code execution or crash Asterisk.","category":"package","nicknames":[],"who_cares":["asterisk","voip","sip","pbx"],"confidence":0.6,"needs_auth":"yes","worst_case":"Remote code execution on the Asterisk server or a crash","analyst_note":"Confirm the affected release range for later tracks, since the advisory says chan_sip was removed there while metadata lists them; check the Asterisk security advisory for the exact scope.","how_to_check":"- Run `asterisk -rx \"module show like chan_sip\"` to see whether chan_sip is loaded\n- Check sip.conf for `textsupport=yes` in the relevant peer or general section (default is no)\n- Confirm the installed release against the fixed versions listed in the fix","needs_analyst":true,"not_affected_if":["textsupport-disabled","chan-sip-not-loaded","pjsip-only"],"who_is_affected":"Only deployments that have chan_sip installed, configured and running with textsupport enabled are exposed. chan_sip was deprecated in Asterisk 20 and removed in later releases, so systems on those releases cannot be exposed through it. The advisory's affected release-track scope is unresolved in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":3511,"output_tokens":707,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-57189':16A,19A '20':134C '20.20.1':149C '20.7':157C '21.12.3':150C '22.10.1':151C '22.8':160C '23.4.1':153C 'accumul':49B,90C 'advisori':179C 'affect':73C,163C 'allow':96C 'asterisk':1A,20B,41B,60B,61C,102C,133C,148C,156C 'attack':27B,77C 'authent':26B,76C 'bound':7A,38B,86C 'branch':67C 'care':92C 'caus':33B,79C,101C 'cert11':158C 'cert3':161C 'certifi':155C 'chan':10A,106C,127C,183C 'channel':108C 'code':56B,98C 'comparison':143C 'complet':136C 'configur':114C 'contain':146C 'craft':30B,93C 'crash':59B,104C 'cve':14A,17A 'default':123C 'deploy':74C 'deprec':131C 'driver':109C,129C,185C 'enabl':121C 'even':176C 'exchang':68C 'execut':57B,99C 'generat':48B,89C 'handl':46B 'includ':172C 'instal':112C 'later':140C,173C 'lead':53B 'may':78C 'metadata':171C 'must':110C,119C 'open':64C 'option':118C 'out-of-bound':4A,35B,83C 'packag':21B 'packet':31B,94C 'patch':145C 'pbx':22B 'potenti':95C 'privat':66C 'red':3A,44B,82C 'releas':165C,174C 'release-track':164C 'remain':168C 'remot':55B,97C 'remov':137C,187C 'repositori':142C 'requir':182C 'say':180C 'scope':167C 'send':29B 'sip':11A,23B,107C,128C,184C 'sourc':65C 'structur':170C 'support':13A 't.140':2A,43B,81C 'telephoni':70C 'text':12A,45B 'textsupport':117C,122C 'though':177C 'toolkit':71C 'track':166C,175C 'unresolv':169C 'use':91C 'verifi':144C 'version':141C 'via':9A 'voip':24B 'write':8A,39B,51B,87C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that have chan_sip installed, configured and running with textsupport enabled are exposed. chan_sip was deprecated in Asterisk 20 and removed in later releases, so systems on those releases cannot be exposed through it. The advisory's affected release-track scope is unresolved in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57189","severity":null,"published_at":"2026-10-27T17:17:01+00:00","modified_at":"2026-10-27T17:17:01+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}