CVE-2026-57184: Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

Q: Which deployments are exposed to this issue?

Only deployments with the chan_ooh323 H.323 addon channel driver explicitly compiled and installed are affected. The driver is not included by default, and its port must also be publicly reachable for an unauthenticated remote attacker to exploit the issue.

Q: What does an attacker need to do to trigger the vulnerability?

An unauthenticated attacker needs network access to the publicly reachable chan_ooh323 port and must send carefully crafted Q.931 setup packets. Successful exploitation may crash Asterisk through an out-of-bounds read.

Q: Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1. It is also fixed in Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 26, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chanooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

2 affected components

Asterisk Asterisk<20.20.1, <21.12.3, <22.10.1, <23.4.1

Asterisk Certified Asterisk<20.7-cert11, <22.8-cert3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 26, 2026

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only deployments with the chan_ooh323 H.323 addon channel driver explicitly compiled and installed are affected. The driver is not included by default, and its port must also be publicly reachable for an unauthenticated remote attacker to exploit the issue.

What does an attacker need to do to trigger the vulnerability?

An unauthenticated attacker needs network access to the publicly reachable chan_ooh323 port and must send carefully crafted Q.931 setup packets. Successful exploitation may crash Asterisk through an out-of-bounds read.

Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1. It is also fixed in Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57184: Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Which releases contain the fix?