EUVD-2026-111220Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public chan_ooh323 H.323 port
-
DeliverySend crafted H.323 packet
-
ExploitOverflow fixed 2048-byte ooTrace buffer
-
ExecutionCorrupt stack via unbounded vsprintf
-
ImpactCrash Asterisk process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the chan_ooh323 addon channel driver to be explicitly compiled and installed - it is NOT built or enabled in a default Asterisk installation - and the H.323 port it serves must be publicly reachable by the attacker. Given those preconditions, the CVSS vector (PR:N/UI:N) confirms the trigger itself is remote and unauthenticated with no user interaction: a single crafted H.323 packet. The non-default, optional nature of chan_ooh323 and the requirement for its port to be internet-exposed are the primary factors limiting real-world exploitability; deployments without the addon are not affected at all. |
| Impact | This is a denial-of-service vulnerability (availability-only impact), not a confirmed code-execution flaw, despite the CWE-787 out-of-bounds write classification: the vendor advisory and NVD description both state only that a crafted packet 'causes the Asterisk process to crash.' The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates a remote, low-complexity, unauthenticated trigger with high availability impact and no confidentiality or integrity impact - consistent with the description. No EPSS score, KEV listing, or SSVC automatable/technical-impact fields were supplied, so widespread-exploitation probability cannot be quantified from the input; absence of these is not evidence either way. No public exploit was identified in the input - the GitHub links are the vendor security advisory, patch commits, and fixed-release tags, not exploit code. The decisive risk limiter is deployment: the chan_ooh323 addon is not compiled or installed by default and its port must be publicly reachable, which sharply narrows the real-world exposed population. Net: a genuine remote unauthenticated DoS for the small subset of operators running the non-default H.323 addon exposed to the internet, but a low-urgency issue for the large majority of Asterisk deployments that do not; the vuln.today priority label is 'this_week,' not act_now or emergency. |
| Exploit ScenarioDerived | An attacker who can reach the public UDP/TCP port served by the chan_ooh323 H.323 channel driver sends a single carefully crafted H.323 packet whose contents expand, via an unbounded vsprintf in the ooTrace()/ooh323c_trace logging path, beyond the fixed 2048-byte stack buffer. The resulting stack buffer overflow crashes the Asterisk process, dropping telephony service. No public exploit code was identified in the provided data, and exploitation only works where the non-default addon is compiled, installed, and internet-reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack buffer overflow in the ooTrace() trace-logging routine of Asterisk's optional chan_ooh323 H.323 channel driver lets remote unauthenticated attackers crash the PBX with a single crafted H.323 packet, producing a denial of service (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). Only installations that explicitly compiled and installed the chan_ooh323 addon - it is not part of a default build - and that expose its H.323 port to untrusted networks are affected; every other Asterisk deployment is out of scope. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied, but vendor fixes are already published for all supported branches. The vendor advisory and the CVE description frame the outcome as a process crash, not confirmed code execution, despite the CWE-787 out-of-bounds write classification.
RemediationAI
Upgrade to the vendor-released fixed versions: Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3, as listed in GHSA-x348-j6c9-77f3 and the matching GitHub release tags; the fixes are also available as individual commits (for example 2d7b8c8dc13d9ead8b6f36cc38b6dd91cd4abd3a), which replace the fixed 2048-byte stack buffer and vsprintf() in addons/ooh323c/src/ootrace.c with a bounds-safe ast_vasprintf() allocation. Because the vulnerable code only exists in the optional chan_ooh323 addon, sites that do not need H.323 can eliminate the exposure entirely by ensuring the module is not selected in menuselect and not installed or loaded, which has no effect on SIP, IAX2 or other channel drivers. Where H.323 must remain in service, restrict the chan_ooh323 listener port to trusted telephony peers with firewall or ACL rules rather than exposing it to the public internet - the trade-off is that off-net or roaming H.323 endpoints will no longer register until the upgrade is applied. Updating is the complete fix; the vendor advisory presents no other software-level mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in addons/ooh323c/src/ootrace.c inside the ooh323c H.323 stack bundled with the chan_ooh323 addon driver. ooTrace() is a printf-style trace formatter that builds each log line into a fixed-size stack array, char logMessage[MAXLOGMSGLEN], where MAXLOGMSGLEN is 2048 bytes, and previously wrote into it with the unbounded vsprintf(). When the formatted trace string - which can incorporate attacker-influenced packet content - exceeds the 2048-byte buffer, the write runs past the end of the stack frame (CWE-787, out-of-bounds write), corrupting saved state and causing the Asterisk process to abort. The upstream fix replaces the fixed stack buffer and vsprintf() with ast_vasprintf(), which heap-allocates the exact required size, checks the return value, and frees the buffer afterward; separate commits across the supported branches carry the same change. Because the vulnerable function is a logging/tracing helper, the exact set of packets and trace levels that reach the formatting call is not spelled out in the available sources beyond the advisory statement that a crafted H.323 packet triggers it. Exploitability is bounded by two preconditions the vendor explicitly calls out: the chan_ooh323 module must have been selected and installed (it is not built by default), and the port it listens on must be reachable from the attacker's network.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted packet with no interaction (AV:N/AC:L/PR:N/UI:N); crash-only impact yields A:H with C:N/I:N and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace() trace-logging function can occur when unbounded vsprintf writes into a fixed 2048-byte buffer. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
CWE-787 (out-of-bounds write), specifically a stack buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity vulnerability in an optional Asterisk PBX module, chan_ooh323, allows unauthenticated remote attackers to crash the phone system via a single crafted H.323 packet. Only organizations that have explicitly enabled this add-on and exposed its port to untrusted networks are at risk, but those affected face immediate service disruption and potential downtime costs for all telephony services. Leadership should ensure IT confirms whether this module is deployed and applies the vendor patch promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB