CVE-2026-57189: Asterisk: Possible RED T.140 Generation Accumulation OOB Write
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The chansip channel driver must be installed and configured, and its textsupport option must be enabled; textsupport defaults to no. The chansip driver was deprecated in Asterisk 20 and completely removed in all later versions. Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required chansip driver was removed there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3 - Configuration
Disable the chan_sip textsupport option to prevent the T.140 RED generation accumulation code path from being enabled.
Asterisk chan_sip textsupport = no
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Exposure requires the deprecated chan_sip channel driver to be both installed and configured, with its textsupport option enabled. Deployments using later Asterisk versions where chan_sip has been completely removed do not meet this prerequisite, despite unresolved structured release-track metadata.
What access does an attacker need?
An attacker must be authenticated and able to send carefully crafted T.140 RED packets to trigger the generation-accumulation out-of-bounds write.
Are default chan_sip configurations affected?
No. The required textsupport option defaults to no, so a default chan_sip configuration does not enable the vulnerable text-support path.
What can be done before patching?
Disable chan_sip textsupport, or remove or stop using chan_sip where operationally feasible. This removes the stated prerequisite for exploitation.
Which releases are verified to contain the patch?
Patch containment is verified in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3.