CVE-2026-57201: Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace() trace-logging function can occur when unbounded vsprintf writes into a fixed 2048-byte buffer. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed?
Only deployments with the chan_ooh323 addon channel driver explicitly compiled and installed are affected. This driver is not installed by default, and the relevant H.323 port must be publicly reachable for remote exposure.
What does an attacker need to exploit this issue?
An attacker can send a carefully crafted packet to the publicly reachable H.323 service. No privileges or user interaction are required according to the supplied severity vector.
What is the likely impact?
A successful attack may cause the Asterisk process to crash, resulting in a denial of service. The provided vector indicates no stated confidentiality or integrity impact.
What can be done if upgrading is not immediately possible?
Remove or disable the explicitly installed chan_ooh323 addon channel driver if it is not needed, or prevent public access to its H.323 port. These measures address the stated prerequisites for remote exploitation.
Which releases contain the fix?
Fixed releases are Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3.