CVE-2026-23740: Asterisk vulnerable to potential privilege escalation
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when astcoredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23740?
CVE-2026-23740 has been rated as a medium severity privilege escalation vulnerability.
How do I fix CVE-2026-23740?
To fix CVE-2026-23740, upgrade to Asterisk versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2 or later.
What systems are affected by CVE-2026-23740?
CVE-2026-23740 affects Asterisk versions prior to 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Is CVE-2026-23740 a remote exploitation risk?
CVE-2026-23740 is not a remote exploitation risk but allows for privilege escalation locally.
What does CVE-2026-23740 exploit?
CVE-2026-23740 exploits the world-writable permissions of directories used by ast_coredumper for output files.