EUVD-2026-111221Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to chan_sip SIP channel
-
ExploitSend oversized crafted T.140 RED packets
-
ExecutionTrigger OOB write during RED generation accumulation
-
ImpactAchieve code execution or crash Asterisk
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete conditions, all drawn from the advisory: (1) the legacy chan_sip channel driver must be installed and configured - this driver was deprecated in Asterisk 20 and completely removed in all later versions, so it is absent from default modern builds; (2) the chan_sip textsupport option must be explicitly enabled, which defaults to 'no'; and (3) the attacker must be authenticated (CVSS PR:L) and able to send crafted T.140 RED packets that overflow the 255-byte generation accumulation buffer. The combination of required authentication, the non-default textsupport setting, and the removed/deprecated chan_sip driver sharply limits the realistically exploitable deployment base and is the primary reason real-world risk is far lower than the RCE label alone suggests. |
| Impact | All decision signals point to low real-world priority despite the RCE potential. The vendor CVSS 4.0 base score is 2.3 (Low) and vuln.today's Decision label is 'monitor'. There is no CISA KEV listing, no EPSS score was provided in the input, and no public exploit or PoC reference is present (only patch commits and release tags). The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L) shows network reach but requires an authenticated attacker (PR:L) and carries an Attack Requirement (AT:P), reflecting the dependency on a specific non-default deployment. Crucially, the vulnerable code path only exists when the deprecated chan_sip driver is installed and its textsupport option - which defaults to 'no' - is explicitly enabled, so the exploitable population is far smaller than Asterisk's overall footprint. One conflict must be stated explicitly: the advisory says chan_sip was removed in Asterisk versions after 20, yet the structured EUVD metadata lists vulnerable 21.x, 22.x and 23.x release tracks (down to fixes 21.12.3, 22.10.1, 23.4.1) - the affected release-track scope is unresolved and should be verified against each deployment's actual chan_sip presence. |
| Exploit ScenarioDerived | An attacker who already holds valid credentials on an Asterisk server running the legacy chan_sip driver with textsupport enabled sends carefully crafted T.140 RED text packets whose payload exceeds the 255-byte (UCHAR_MAX) generation buffer. During generation accumulation this causes an out-of-bounds write that can crash Asterisk or potentially lead to remote code execution. No public exploit or PoC code was identified in the provided sources; the attack is constrained by the required authentication and the non-default text-support configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds write in Asterisk's T.140 RED generation accumulation can corrupt memory, crash the process, or potentially enable code execution, but only for deployments running the legacy chan_sip channel driver with the non-default textsupport option enabled and only by an authenticated attacker sending crafted packets. The vendor CVSS 4.0 score is 2.3 and the independent assessment treats exploitation as high-complexity with low confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and the vuln.today priority is monitor.
RemediationAI
Vendor-released patch: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, or 23.4.1, and Certified Asterisk 20.7-cert11 or 22.8-cert3; release tags and commit fixes are linked from the GitHub advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94. Where upgrade is not immediately possible, ensure the chan_sip textsupport option remains at its default 'no' or remove the deprecated chan_sip driver if it is not required, since the advisory lists both as preconditions; disabling textsupport disables T.140 text over chan_sip, and removing chan_sip disables that channel driver entirely. Deployments without chan_sip installed are outside the described precondition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-787 out-of-bounds write in res/res_rtp_asterisk.c within the T.140 RED (redundancy) handling used for real-time text. The RED generation payload size is tracked through red->len, an array of unsigned char, which limits accumulated payloads to UCHAR_MAX (255) bytes; the patch adds checks that truncate oversized T.140 frames or flush and then discard frames that would exceed the limit. Because the affected path is reached through chan_sip text support, exploitation requires chan_sip installed and configured with textsupport enabled, which defaults to 'no'. The advisory states chan_sip was deprecated in Asterisk 20 and removed in later versions, so structured version metadata covering later release tracks is broader than the advisory's stated deployment precondition. The exact packet-level trigger beyond the generation accumulation path is not fully described in the available sources.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated SIP user (PR:L) sending crafted packets; reliance on non-default textsupport and legacy chan_sip gives AC:H; 255-byte-truncated OOB write yields limited C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The chan_sip channel driver must be installed and configured, and its textsupport option must be enabled; textsupport defaults to no. The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions. Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required chan_sip driver was removed there.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB