DEBIAN-CVE-2026-57194: Medium severity debian/asterisk vulnerability

Q: Which deployments are realistically exposed to this issue?

Deployments are exposed only if the chan_unistim module is loaded and configured with a valid UNISTIM UDP port reachable by the attacker. The attacker must also be able to register as a configured phone MAC, or use an equivalent production or autoprovisioning path that reaches the main page.

Q: What does an attacker need to do to trigger the vulnerability?

An attacker must send a carefully crafted incoming request packet that reaches the UNISTIM DIALPAGE handling path. Exploitation has high attack complexity and does not require privileges or user interaction, but requires the specific UNISTIM access conditions described.

Q: What is the impact of successful exploitation?

The out-of-bounds write can overflow the phone_number field and crash Asterisk. The provided severity vector indicates an availability impact, with no stated confidentiality or integrity impact.

Q: Which versions contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chanunistim DIALPAGE digit handling can overflow the phonenumber field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The chanunistim module must be loaded and configured with a valid UNISTIM UDP port that the attacker can reach. The attacker must register as a configured phone MAC, or the deployment must have an equivalent production/autoprovisioning path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1

Event History

Oct 27, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments are exposed only if the chan_unistim module is loaded and configured with a valid UNISTIM UDP port reachable by the attacker. The attacker must also be able to register as a configured phone MAC, or use an equivalent production or autoprovisioning path that reaches the main page.

What does an attacker need to do to trigger the vulnerability?

An attacker must send a carefully crafted incoming request packet that reaches the UNISTIM DIALPAGE handling path. Exploitation has high attack complexity and does not require privileges or user interaction, but requires the specific UNISTIM access conditions described.

What is the impact of successful exploitation?

The out-of-bounds write can overflow the phone_number field and crash Asterisk. The provided severity vector indicates an availability impact, with no stated confidentiality or integrity impact.

Which versions contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.

DEBIAN-CVE-2026-57194: Medium severity debian/asterisk vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the impact of successful exploitation?

Which versions contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the impact of successful exploitation?

Which versions contain fixes?