DEBIAN-CVE-2026-57201: Buffer Overflow

Q: Are default Asterisk installations exposed?

No. The affected chan_ooh323 addon channel driver must be explicitly compiled and installed; it is not installed by default.

Q: What must an attacker be able to reach to trigger the issue?

An attacker needs network access to the publicly reachable port used by the installed chan_ooh323 driver. No authentication or user interaction is required according to the provided vector.

Q: How can I determine whether my deployment needs remediation?

Check whether chan_ooh323 was compiled and installed, whether its port is publicly reachable, and whether the installed Asterisk release predates the listed fixed version for its release line.

Q: What can reduce exposure if an update cannot be applied immediately?

Remove or disable the chan_ooh323 addon driver if it is not needed, or prevent public access to its port. These measures address the stated prerequisites for remote exploitation.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace() trace-logging function can occur when unbounded vsprintf writes into a fixed 2048-byte buffer. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are default Asterisk installations exposed?

No. The affected chan_ooh323 addon channel driver must be explicitly compiled and installed; it is not installed by default.

What must an attacker be able to reach to trigger the issue?

An attacker needs network access to the publicly reachable port used by the installed chan_ooh323 driver. No authentication or user interaction is required according to the provided vector.

How can I determine whether my deployment needs remediation?

Check whether chan_ooh323 was compiled and installed, whether its port is publicly reachable, and whether the installed Asterisk release predates the listed fixed version for its release line.

What can reduce exposure if an update cannot be applied immediately?

Remove or disable the chan_ooh323 addon driver if it is not needed, or prevent public access to its port. These measures address the stated prerequisites for remote exploitation.

DEBIAN-CVE-2026-57201: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default Asterisk installations exposed?

What must an attacker be able to reach to trigger the issue?

How can I determine whether my deployment needs remediation?

What can reduce exposure if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Are default Asterisk installations exposed?

What must an attacker be able to reach to trigger the issue?

How can I determine whether my deployment needs remediation?

What can reduce exposure if an update cannot be applied immediately?