CVE-2026-57199: Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, appsms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the SMS dialplan application, which is useful when routing calls to or from analog devices, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure requires an administrator to have explicitly configured use of the SMS dialplan application. The application is useful for routing calls to or from analog devices; deployments that do not use it are not described as affected by this issue.
What must an attacker control to exploit the issue?
An attacker needs externally controlled SMS length values to reach app_sms.c through the SMS dialplan application, where the supplied data has not been validated. The resulting condition can corrupt memory or crash Asterisk.
What can be done if upgrading is not immediately possible?
Disable or avoid use of the SMS dialplan application where feasible. If it must remain enabled, ensure data passed to the application is valid.
Which releases contain the fix?
The fix is available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.