{"id":"CVE-2026-57198","kind":"vulnerability","aliases":["CVE-2026-57198"],"related":[],"title":"Asterisk: crafted T.140 RED packets overflow heap buffer via chan_sip","description":"Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.","summary":"Asterisk's chan_sip driver has a heap buffer overflow in T.140 RED text handling, triggered by specially crafted packets. An authenticated attacker may be able to run code on the server or crash Asterisk.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","runtime","self-hosted","sip","telephony"],"not_affected_if":["chan-sip-not-configured","textsupport-default-no"],"how_to_check":"- Run `asterisk -V` to get the installed version.\n- Check whether chan_sip is loaded and configured, for example with `asterisk -rx \"module show like chan_sip\"`.\n- Check whether `textsupport` is set to yes in the chan_sip configuration.","fix":"- Move to a patched release: `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk `20.7-cert11` or `22.8-cert3`.\n- If chan_sip is in use, keep `textsupport` at its default of `no` until patched.","status":"open","published_at":"2026-10-27T17:17:01+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:35:09+00:00","updated_at":"2026-10-27T17:35:09+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T17:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a patched release: `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk `20.7-cert11` or `22.8-cert3`.\n- If chan_sip is in use, keep `textsupport` at its default of `no` until patched.","reach":"network","title":"Asterisk: crafted T.140 RED packets overflow heap buffer via chan_sip","impact":"high","summary":"Asterisk's chan_sip driver has a heap buffer overflow in T.140 RED text handling, triggered by specially crafted packets. An authenticated attacker may be able to run code on the server or crash Asterisk.","category":"runtime","nicknames":[],"who_cares":["asterisk","sip","telephony","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Remote code execution or crash on the PBX server","analyst_note":"Confirm the affected release tracks against the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-57198, since the sources conflict on whether later tracks include chan_sip.","how_to_check":"- Run `asterisk -V` to get the installed version.\n- Check whether chan_sip is loaded and configured, for example with `asterisk -rx \"module show like chan_sip\"`.\n- Check whether `textsupport` is set to yes in the chan_sip configuration.","needs_analyst":true,"not_affected_if":["chan-sip-not-configured","textsupport-default-no"],"who_is_affected":"Only deployments that have chan_sip installed and configured with textsupport enabled are exposed. The sources say chan_sip was deprecated in Asterisk 20 and removed in later versions, so systems on newer tracks without chan_sip can skip it, but the affected release range is not settled.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.001165,"input_tokens":3502,"output_tokens":1630,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57198':14A,17A '20':128C '20.20.1':143C '20.7':151C '21.12.3':144C '22.10.1':145C '22.8':154C '23.4.1':147C 'abl':50B 'advisori':173C 'affect':72C,157C 'allow':90C 'asterisk':1A,18B,25B,59B,60C,96C,127C,142C,150C 'attack':47B,76C 'authent':46B,75C 'branch':66C 'buffer':8A,33B,83C 'care':86C 'caus':78C,95C 'cert11':152C 'cert3':155C 'certifi':149C 'chan':10A,27B,100C,121C,177C 'channel':102C 'code':53B,92C 'comparison':137C 'complet':130C 'configur':108C 'contain':140C 'craft':2A,43B,87C 'crash':58B,98C 'cve':12A,15A 'default':117C 'deploy':73C 'deprec':125C 'driver':29B,103C,123C,179C 'enabl':115C 'even':170C 'exchang':67C 'execut':93C 'handl':39B 'heap':7A,32B,82C 'host':22B 'includ':166C 'instal':106C 'later':134C,167C 'may':48B,77C 'metadata':165C 'must':104C,113C 'open':63C 'option':112C 'overflow':6A,34B,84C 'packet':5A,44B,88C 'patch':139C 'potenti':89C 'privat':65C 'red':4A,37B,81C 'releas':159C,168C 'release-track':158C 'remain':162C 'remot':91C 'remov':131C,181C 'repositori':136C 'requir':176C 'run':52B 'runtim':19B 'say':174C 'scope':161C 'self':21B 'self-host':20B 'server':56B 'sip':11A,23B,28B,101C,122C,178C 'sourc':64C 'special':42B 'structur':164C 't.140':3A,36B,80C 'telephoni':24B,69C 'text':38B 'textsupport':111C,116C 'though':171C 'toolkit':70C 'track':160C,169C 'trigger':40B 'unresolv':163C 'use':85C 'verifi':138C 'version':135C 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Only deployments that have chan_sip installed and configured with textsupport enabled are exposed. The sources say chan_sip was deprecated in Asterisk 20 and removed in later versions, so systems on newer tracks without chan_sip can skip it, but the affected release range is not settled.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57198","severity":null,"published_at":"2026-10-27T17:17:01+00:00","modified_at":"2026-10-27T17:17:01+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}