---
id: "CVE-2026-57191"
kind: "vulnerability"
aliases: ["CVE-2026-57191"]
title: "Asterisk: unbounded sscanf in MWI NOTIFY lets unauthenticated packets crash SIP"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asterisk", "package", "self-hosted", "sip", "telephony", "voip"]
not_affected_if: ["no-pjsip", "patched-version", "sip-not-exposed"]
published_at: "2026-10-27T22:17:27+00:00"
first_seen_at: "2026-10-27T22:29:29+00:00"
updated_at: "2026-10-27T22:30:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57191", "first_seen_at": "2026-10-27T22:29:29+00:00"}]
---

# Asterisk: unbounded sscanf in MWI NOTIFY lets unauthenticated packets crash SIP

Asterisk's res_pjsip_pubsub module parses the Message-Account field of MWI NOTIFY messages with an unbounded sscanf, causing a stack buffer overflow. An unauthenticated attacker can send a crafted SIP packet that corrupts the transport and permanently disables all SIP functionality until Asterisk is restarted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Asterisk version with `asterisk -V` and compare against the fixed releases listed below.
- Confirm whether the PJSIP stack and the res_pjsip_pubsub module are loaded with `asterisk -rx "module show like pubsub"`.

## Fix

- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1` for the mainline releases.
- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.
- Restart Asterisk after upgrading to restore SIP service if it was already disabled.

## Timeline

- 2026-10-27T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57191

## From the sources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_