CVE-2026-57194: Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chanunistim DIALPAGE digit handling can overflow the phonenumber field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The chanunistim module must be loaded and configured with a valid UNISTIM UDP port that the attacker can reach. The attacker must register as a configured phone MAC, or the deployment must have an equivalent production/autoprovisioning path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
A deployment is exposed only if the chan_unistim module is loaded and configured with a valid UNISTIM UDP port reachable by the attacker. The attacker must also be able to register as a configured phone MAC address, or use an equivalent production or autoprovisioning path to reach the main page.
What does exploitation require and what is the impact?
An unauthenticated network attacker must send a carefully crafted incoming request packet after meeting the UNISTIM access conditions. Successful exploitation can crash Asterisk through an out-of-bounds write; the provided impact assessment identifies availability impact only.
What can be done before patching is available?
Limit reachability to the configured UNISTIM UDP port and prevent untrusted clients from registering as configured phone MAC addresses or reaching the main page through provisioning paths. These measures address the stated prerequisites for exploitation.
Which releases contain the fix?
The fix is in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1. For Certified Asterisk, it is in 20.7-cert11 and 22.8-cert3.