EUVD-2026-110305Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public chan_ooh323 H.323 port
-
ExploitSend crafted Q.931 setup packet
-
ExecutionTrigger out-of-bounds read in IE parser
-
ImpactCrash Asterisk and deny telephony
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the optional chan_ooh323 H.323 addon channel driver to be explicitly compiled and installed - this is NOT the default build - and its listening port must be publicly reachable by the attacker. Given those preconditions, the trigger is an unauthenticated (PR:N) remote network-crafted Q.931 setup packet whose malformed information-element length fields drive the parser out of bounds. Strong limiting factors: the vulnerable code is absent unless deliberately built in, the port must be exposed to the attacker, and impact is confined to crashing the service (VA:L) with no confidentiality or integrity effect; deployments using the default Asterisk build or without a public H.323 port are not exposed. |
| Impact | This is a moderate-severity, availability-only denial-of-service flaw that is unlikely to be a top-tier emergency but warrants timely patching per its decision signals. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, but critically scores only VA:L with VC:N/VI:N - meaning no confidentiality or integrity impact and limited availability impact (a crash), consistent with CWE-125 out-of-bounds read used to crash the process rather than leak or execute. The AT:P (attack requirement present) metric aligns with the vendor-stated precondition that the chan_ooh323 addon be explicitly compiled, installed, and its port publicly reachable - a configuration that is NOT the default. Exploitation signals are modest and consistent: EPSS is 0.56% (46th percentile), the CVE is NOT in CISA KEV, and no public exploit code or PoC reference is present in the input (only vendor advisory, patch commits, and release tags). The vuln.today decision label is 'this_month', indicating prioritized-but-not-emergency handling. Net: a real, patchable network DoS gated heavily by a non-default build/deployment condition - genuine priority only for the subset of operators who have deliberately enabled chan_ooh323 with a public H.323 port; for everyone else the practical risk is near zero because the vulnerable code is not even compiled in. |
| Exploit ScenarioDerived | An operator has built and installed the optional chan_ooh323 H.323 addon and exposed its listening port to untrusted networks. A remote, unauthenticated attacker sends a carefully crafted Q.931 setup packet whose information-element length fields drive the parser past the buffer bounds, causing an out-of-bounds read that crashes Asterisk and drops telephony service. No public exploit code or PoC reference is present in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds read in the Q.931 information-element parser of the chan_ooh323 H.323 addon channel driver lets unauthenticated remote attackers crash Asterisk 20.x, 21.x, 22.x and 23.x releases (fixed in 20.20.1, 21.12.3, 22.10.1 and 23.4.1) plus Certified Asterisk 20.7-cert and 22.8-cert branches (fixed in 20.7-cert11 and 22.8-cert3) by sending a crafted Q.931 setup packet. Exposure is strongly conditional: chan_ooh323 is not part of a default build and must be explicitly compiled and installed, and its listening port must be reachable from the attacker's network. Impact is limited to denial of service (availability only, no confidentiality or integrity effect); EPSS is 0.56% (46th percentile) and no public exploit code and no CISA KEV entry were identified at time of analysis, so this is a timely-patching item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1 depending on branch, or to Certified Asterisk 20.7-cert11 or 22.8-cert3 (release tags at https://github.com/asterisk/asterisk/releases/tag/20.20.1, .../21.12.3, .../22.10.1, .../23.4.1, .../certified-20.7-cert11 and .../certified-22.8-cert3; advisory https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f). Because the flaw lives in an addon that is not built by default, the most direct compensating control for systems that cannot be patched immediately is to confirm chan_ooh323 is not compiled or loaded (do not select it in menuselect, and ensure it is absent from modules.conf) - the trade-off is complete loss of H.323 channel support on that server. Where H.323 must stay in service, restrict the chan_ooh323 listener to trusted peer networks with a firewall or Asterisk ACL so that arbitrary internet hosts cannot deliver Q.931 setup packets; this narrows but does not remove exposure from inside the permitted address range. Upgrading to the fixed releases is the complete fix; the vendor does not describe any other mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Asterisk's chan_ooh323 is an optional addon channel driver built on the Objective Systems ooh323c H.323 stack; it implements the Q.931 call-control signalling layer used to set up and tear down H.323 calls. In ooQ931Decode (addons/ooh323c/src/ooq931.c), each information element begins with a discriminator byte; if the high bit is clear, one or two length bytes follow before the payload. The original code advanced the offset to read the length byte without confirming that a byte remained after the discriminator, and likewise advanced past the second length byte and the nested protocol discriminator without re-checking against the packet length. A packet whose element ends immediately after the discriminator (or after a truncated 16-bit length) therefore drives the parser past the end of the received buffer. That is the CWE-125 out-of-bounds read class: the parser consumes bytes it does not own, and the resulting invalid access terminates the Asterisk process. The upstream fix converts the unconditional post-increment into pre-validated advances and returns Q931_E_INVLENGTH when the offset reaches the packet length, covering both the 8-bit and 16-bit length encodings.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated crafted packet (AV:N/AC:L/PR:N/UI:N); out-of-bounds read yields only a service crash so C:N/I:N and A:L; no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chan_ooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB