EUVD-2026-111103Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain SIP auth (credentials or trusted source IP)
-
DeliveryCraft malicious SIP NOTIFY with MWI body
-
ExploitTrigger buffer over-read in PJSIP MWI parser
-
ExecutionCrash Asterisk process
-
ImpactTelephony service denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | Exploitation requires the attacker to first pass Asterisk SIP authentication for a configured endpoint - either with valid username/password credentials or by sending from a source IP address that matches an endpoint's permitted address (IP-based matching). With that satisfied, the attacker sends a single crafted SIP NOTIFY request whose MWI body triggers an over-read in the PJSIP MWI body parser (res_pjsip_pubsub.c). Limiting factors: this is authenticated-only (PR:L), affects only deployments using the PJSIP stack that process MWI NOTIFY requests, impacts availability only (process crash), and applies to Asterisk prior to 20.20.1/21.12.3/22.10.1/23.4.1 and Certified Asterisk prior to 20.7-cert11/22.8-cert3. The specific malformed-body condition that causes the over-read is not further detailed beyond the fix adding a body-length bounds check. |
| Impact | This is a moderate-severity denial-of-service issue, not a code-execution or data-exposure flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: network-reachable, low complexity, but requiring low privileges (PR:L) because the attacker must first pass SIP authentication - either via username/password or by source-IP address matching. Impact is availability-only (A:H; C:N/I:N), matching a buffer over-read (CWE-126/CWE-170) that crashes the process rather than leaking or corrupting data. No EPSS score, KEV listing, or verified proof-of-concept is present in the input; the only exploit-adjacent references are the vendor advisory and the fix commits (patch artifacts, not an exploit), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a patch-this-cycle DoS rather than an emergency. Net: a genuine but bounded operational risk - real priority for exposed/multi-tenant SIP deployments because authentication can be satisfied by IP matching, but not a drop-everything issue given the authentication gate and availability-only impact. |
| Exploit ScenarioDerived | An attacker who already satisfies SIP authentication - through valid username/password credentials or by originating from a source IP that matches an endpoint's permitted address - sends a carefully crafted SIP NOTIFY request that drives the PJSIP MWI (message-waiting indication) body parser into a buffer over-read, crashing Asterisk and interrupting telephony service. No public, verified exploit code is identified in the available sources; only the vendor advisory and remediation commits are referenced. Attack complexity is low once authentication is obtained, so a compromised or IP-trusted endpoint is sufficient. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An authenticated SIP peer can crash Asterisk by sending a single crafted SIP NOTIFY request whose Message Waiting Indication (MWI) body over-reads a buffer in the PJSIP MWI body parser, terminating the process and dropping all calls and registrations handled by it. The attacker must first satisfy Asterisk's SIP authentication, either with valid endpoint credentials or by sending from a source IP that matches an endpoint's permitted address, so exposure is limited to deployments using the PJSIP stack that process MWI NOTIFY requests. Asterisk versions up to 20.20.0, 21.12.2, 22.10.0 and 23.4.0 and Certified Asterisk up to 20.7-cert10 and 22.8-cert2 are affected; fixes are released in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 and 22.8-cert3, and no public exploit has been identified at time of analysis. Impact is availability only (CVSS 6.5, A:H) - there is no code execution or data exposure.
RemediationAI
Vendor-released patch: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 or 22.8-cert3, as applicable to your branch; the corresponding source commits (for example 07aec894a1fdfa7fa989d3ab40fdf0dcda8005bb) add the missing body-length bounds check in pubsub_on_rx_mwi_notify_request(). Release artifacts and notes are at https://github.com/asterisk/asterisk/releases/tag/20.20.1, https://github.com/asterisk/asterisk/releases/tag/21.12.3, https://github.com/asterisk/asterisk/releases/tag/22.10.1, https://github.com/asterisk/asterisk/releases/tag/23.4.1, https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 and https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3, with the advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf. Because the vendor lists passing SIP authentication - valid endpoint credentials or source-IP matching - as a precondition, reducing the number of endpoints that can reach the MWI NOTIFY handler (tightening endpoint credentials and auditing IP-based endpoint matching rules) limits who can attempt the crash while patching is staged, though the vendor's complete fix is the update itself. Scheduling follows a this_month priority: this is a moderate-severity availability-only issue, not an emergency, but a single authenticated request can terminate the process and drop active calls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in res_pjsip_pubsub.c within Asterisk's PJSIP-based publish/subscribe stack, in pubsub_on_rx_mwi_notify_request(), the handler that parses inbound SIP NOTIFY requests carrying MWI (message-summary) bodies. Root cause is a buffer over-read (CWE-126) compounded by improper null termination (CWE-170): the handler asked the message body's print_body callback to render the body into a buffer but did not constrain or validate the returned length before treating the result as a null-terminated string. The upstream fix captures print_body's return value in body_len, rejects it when it is negative or larger than rdata->msg_info.msg->body->len (logging 'Unable to print request body' and returning 404), and only then writes the terminating NUL at body[body_len]. CPE data identifies both asterisk (cpe:2.3:a:asterisk:asterisk) and asterisk certified-asterisk (cpe:2.3:a:asterisk:certified-asterisk) as affected product families; both share the same res_pjsip_pubsub code path. The precise malformed-body condition that drives the over-read is not described in the available sources beyond the length check added by the patch, and the outcome of a successful trigger is a process crash rather than memory disclosure or corruption exploitable for code execution.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SIP authentication is mandatory, so PR:L not PR:N; network-reachable NOTIFY with low complexity gives AV:N/AC:L; crash-only impact means C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully crafted SIP NOTIFY request. The attacker must pass SIP authentication using either a username/password or source IP address matching. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB