CVE-2026-57191: Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

Q: Which deployments are exposed to this issue?

Asterisk and Certified Asterisk deployments running versions earlier than the listed fixed releases are affected, provided they process SIP MWI NOTIFY messages through res_pjsip_pubsub. The issue affects the Message-Account field parsing path.

Q: Does exploitation require authentication?

No. An unauthenticated attacker can send a carefully crafted packet containing a malicious MWI NOTIFY Message-Account field.

Q: What is the operational impact of a successful attack?

The stack buffer overflow can corrupt the underlying transport and permanently disable all SIP functionality. Restarting Asterisk is required to restore full operation.

Q: Which versions contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in respjsippubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

2 affected components

Asterisk Asterisk<20.20.1, <21.12.3, <22.10.1, <23.4.1

Asterisk Certified Asterisk<20.7-cert11, <22.8-cert3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3
Operational
Restart Asterisk to restore full operation.

Event History

Oct 27, 2026

CVE Published

via MITRE·09:32 PM

Data Sourced

via MITRE·09:32 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Asterisk and Certified Asterisk deployments running versions earlier than the listed fixed releases are affected, provided they process SIP MWI NOTIFY messages through res_pjsip_pubsub. The issue affects the Message-Account field parsing path.

Does exploitation require authentication?

No. An unauthenticated attacker can send a carefully crafted packet containing a malicious MWI NOTIFY Message-Account field.

What is the operational impact of a successful attack?

The stack buffer overflow can corrupt the underlying transport and permanently disable all SIP functionality. Restarting Asterisk is required to restore full operation.

Which versions contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57191: Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication?

What is the operational impact of a successful attack?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication?

What is the operational impact of a successful attack?

Which versions contain the fix?