EUVD-2026-111344Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain XMPP account on same or federated server
-
DeliveryOpen XMPP session to target res_xmpp
-
ExploitSend stanza with crafted namespace prefix
-
ExecutionOverflow stack buffer in prefix handling
-
ImpactCrash Asterisk telephony service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the res_xmpp module be loaded AND an XMPP connection be configured in xmpp.conf - neither is a default Asterisk configuration - AND the attacker must possess a valid XMPP account on the same server or on a federated server, matching the CVSS PR:L authentication requirement. These are strong limiting factors: a default Asterisk install without XMPP configured is not affected, and the attacker needs an authenticated XMPP identity reachable to the target. Given those preconditions, the trigger is a crafted XMPP packet with a malformed namespace prefix (a node name containing a ':' colon) that overflows the fixed stack buffer in xmpp_action_hook namespace-prefix handling; no victim user interaction is required. |
| Impact | This is a moderate, config-dependent availability risk rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires low privileges (PR:L) and no user interaction, with impact confined to availability (VA:H) and no confidentiality or integrity impact (VC:N/VI:N). The underlying weakness is CWE-787 (out-of-bounds write) via a stack buffer overflow, which in principle can be more dangerous than a crash, but the vendor explicitly scored only availability impact, so the confirmed outcome is denial of service of the Asterisk process. The vuln.today Decision label is 'this_week', indicating a prompt-but-not-immediate patch priority. No CISA KEV listing, no EPSS score, and no PoC/exploit reference are present in the input - only vendor commit diffs and release notes, which are remediation artifacts, not exploit code; the fix changes an unbounded snprintf length computation in res_xmpp namespace-prefix handling to a bounded one. The PR:L requirement plus the narrow preconditions (res_xmpp loaded, XMPP configured, attacker holding an account on the same or a federated server) meaningfully constrain real-world exposure, so this is a real but gated issue, not a widespread drive-by threat. |
| Exploit ScenarioDerived | An attacker who holds an XMPP account on the same Asterisk-connected XMPP server (or a federated one) sends carefully crafted XMPP stanzas with a malformed namespace prefix to a target running res_xmpp with an XMPP connection configured in xmpp.conf. The crafted node name overflows a fixed stack buffer during attribute construction, corrupting the stack and crashing the Asterisk process. No public exploit is identified at time of analysis; only vendor fix commits are available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack buffer overflow in Asterisk's res_xmpp module allows an XMPP-authenticated attacker who can reach the PBX's configured XMPP connection to crash the Asterisk process, giving a high availability impact (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/A:H, 7.1). Only deployments where res_xmpp is loaded and an XMPP connection is defined in xmpp.conf are exposed - neither is part of a default configuration - and the attacker must hold a valid account on the same or a federated XMPP server. Fixed releases are available for all supported branches (20.20.1, 21.12.3, 22.10.1, 23.4.1, plus Certified 20.7-cert11 and 22.8-cert3); no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
RemediationAI
Vendor-released patches fix the overflow: upgrade standard Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1, and Certified Asterisk to 20.7-cert11 or 22.8-cert3, per the advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f and the corresponding release tags. Where upgrading immediately is not possible, the exposure can be removed entirely by not loading the vulnerable module - add 'noload => res_xmpp.so' to modules.conf or delete the offending commit-path code by rebuilding with the upstream patch - with the trade-off that all XMPP messaging, presence and Google Talk-style integration in dialplans stops working. Alternatively, remove the XMPP connection definition from xmpp.conf so the module has nothing to connect to, which likewise disables XMPP features. Because the attacker must present a valid account on the same or a federated XMPP server, restricting XMPP federation and limiting which accounts can reach the Asterisk XMPP connection reduces the attack surface, but this is a compensating control only and does not fix the underlying stack overflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds write (CWE-787) in res_xmpp, Asterisk's XMPP/Google Talk integration module, which parses incoming XMPP stanzas through the iksemel (iks) XML parser. In xmpp_action_hook(), namespace prefixes were handled by locating the colon in an element name with strchr() and then building an 'xmlns:<prefix>' attribute string with snprintf() into a fixed-size stack buffer. The size argument passed to snprintf was derived from strlen("xmlns:") plus the difference between the full node name and the post-colon remainder, rather than from the actual size of the destination buffer, so an element name with an unusually long namespace prefix causes more bytes to be written than the stack buffer can hold. The upstream fix in commit 12072a559f59 replaces the computed length with sizeof(attr) and copies only the prefix using a precision-limited %.*s conversion bounded by the colon offset, ensuring the write can never exceed the destination. Because the corrupted object is stack memory within the XMPP message-processing path, successful exploitation corrupts process state and can terminate Asterisk; the CVSS 4.0 vector as published records no confidentiality or integrity impact. The concrete packet-level trigger beyond 'a node name containing a colon with an oversized prefix' is not described in the available sources.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable XMPP stanza (AV:N), no special timing (AC:L), requires an authenticated XMPP account (PR:L), no interaction (UI:N); vendor scopes impact to availability only (C:N/I:N/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling using carefully crafted packets. The res_xmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
Evidence note: the supplied material is the GitHub Security Advisory (GHSA-mxgm-8c6f-5p8f) only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Asterisk's res_xmpp module contains a stack buffer overflow (CVE-2026-57188) that allows an authenticated XMPP user to crash the PBX process, causing a high availability impact. This affects only organizations that have explicitly loaded the res_xmpp module and configured an XMPP connection, which are non-default settings typically used for XMPP integration in contact centers or unified communications environments. Leadership should care because a successful attack can disrupt telephony services, and while no active exploitation has been observed, the availability risk warrants prompt patching for exposed deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB