Asterisk chan_ooh323 CVE-2026-57186

Exploitation requires three concrete conditions stated by the vendor: (1) the target runs Asterisk version greater than 20 (21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1, or certified-asterisk before 22.8-cert3); (2) the chan_ooh323 addon channel driver has been explicitly compiled and installed, which is NOT the default build configuration; and (3) the port used by chan_ooh323 is open and reachable by the attacker. When those hold, a remote unauthenticated attacker (PR:N, UI:N) sends malformed Q.931 party-number elements in an OOH323 request to trigger the crash. The primary limiting factor is the non-default addon: deployments that never compiled chan_ooh323, or that do not expose its port publicly, are not exposed regardless of CVSS score.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a network-reachable, unauthenticated, low-complexity availability-only flaw - a pure denial of service with no confidentiality or integrity impact. The vuln.today Decision label is 'this_week', consistent with a serious but non-emergency DoS. No EPSS score, SSVC automatability/technical-impact vector, or KEV listing is present in the input, and no PoC or exploit reference is supplied (only the vendor advisory, fix commits, and release tags), so exploitation status is 'no public exploit identified at time of analysis'. The headline network/unauthenticated profile is sharply constrained by preconditions the vendor states explicitly: the chan_ooh323 addon must be deliberately compiled and installed (it is NOT built by default) and its port must be publicly reachable. This makes the realistic exploitable population far smaller than the raw CVSS network vector implies - this is a real priority for the subset of deployments that run chan_ooh323 exposed, but a low-real-risk issue for the default majority that do not. Note the gap: CVSS treats this as broadly network-exploitable, while the description confirms a non-default, operator-enabled attack surface - defenders should verify whether chan_ooh323 is compiled in and internet-facing before prioritizing.

An attacker who can reach an internet-exposed chan_ooh323 (H.323/OOH323) listener on a vulnerable Asterisk instance (version > 20) sends an OOH323 request containing malformed Q.931 party-number elements. The party-number parser in ooq931.c reads outside the valid buffer range (the CVE-2022-37325 bounds check was never forward-ported), crashing the Asterisk process and taking down telephony service. No public exploit code is identified in the provided data, though the fix commits publicly reveal the missing length/offset validation.