EUVD-2026-111397Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Asterisk PJSIP SIP interface
-
ExploitSend crafted MWI NOTIFY with oversized Message-Account
-
ExecutionOverflow stack buffer in res_pjsip_pubsub
-
ImpactCorrupt underlying transport, disable all SIP until restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the PJSIP stack (res_pjsip_pubsub) and process an inbound MWI NOTIFY so that the Message-Account field is parsed by the vulnerable sscanf; the attacker must be able to deliver that SIP NOTIFY to the Asterisk transport. Per the CVSS 4.0 vector the attacker needs no authentication (PR:N) and no user interaction (UI:N), but attack complexity is rated high (AC:H), indicating that reliably crafting a packet that reaches and overflows the parser is non-trivial. Impact is limited to availability: there is no confidentiality or integrity impact (VC:N/VI:N), the effect is a permanent SIP outage requiring an Asterisk restart to recover, and only versions prior to the listed fixes are affected. The available sources do not describe exactly what deployment/subscription state is required for a crafted NOTIFY to reach the parser. |
| Impact | This is a genuine but bounded risk: a remote, unauthenticated availability-only flaw (CVSS 4.0 8.2, VA:H with VC:N/VI:N - no data compromise or code-execution impact is asserted in the vector). The CVSS 4.0 vector rates it AC:H, meaning exploitation is not trivially reliable, which tempers the AV:N/PR:N/UI:N 'remote unauthenticated' exposure. The real-world impact is severe within its class: a successful packet corrupts the underlying PJSIP transport and permanently disables ALL SIP functionality until an Asterisk restart - a full telephony outage, not a transient crash. No EPSS score and no KEV listing were provided, and no public exploit or PoC reference appears in the input, so there is currently no signal of active or at-scale exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch-promptly posture rather than a drop-everything emergency. The input CWE is listed as CWE-120 in the top-level metadata but the GHSA advisory classifies it as CWE-120 AND CWE-787 (out-of-bounds write) - a minor cross-source nuance, not a conflict. The dominant uncertainty is how easily a crafted MWI NOTIFY reaches the vulnerable parser in a default deployment, which the sources do not quantify. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Asterisk PJSIP SIP interface sends a carefully crafted MWI NOTIFY message whose Message-Account field is longer than the destination stack buffer, overflowing it via the unbounded sscanf in res_pjsip_pubsub. The overflow corrupts the underlying transport and permanently disables all SIP functionality, forcing an operator to restart Asterisk to recover. No public exploit or PoC is identified in the available sources, and the CVSS 4.0 vector rates attack complexity high (AC:H), so reliable triggering is not established. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack buffer overflow in Asterisk's res_pjsip_pubsub module allows a remote sender to corrupt a fixed-size buffer while parsing the Message-Account field of an inbound MWI NOTIFY message-summary body, which can corrupt the underlying SIP transport and permanently disable all SIP functionality until the daemon is restarted. Per the CVSS 4.0 vector (8.2) and the assessed CVSS 3.1 vector the attacker needs no authentication (PR:N) and no user interaction (UI:N), but attack complexity is high (AC:H); the impact is availability only (VC:N/VI:N/VA:H), with no confidentiality or integrity loss and no code execution asserted. All Asterisk branches prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 / 22.8-cert3 are affected; no public exploit was identified at time of analysis.
RemediationAI
Vendor-released patch: Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3; upgrade to the fixed release for your branch (details in the GHSA advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx and the release tags such as https://github.com/asterisk/asterisk/releases/tag/22.10.1). The fix is the bounded conversion in res_pjsip_pubsub.c changing "%s" to "%511s" (commits including 0e89514084490070c5ecee419ec5ee37b7c49528), so backporting that commit to an unsupported branch reproduces the vendor change but is not an independently validated release. No workaround is documented in the available sources; note that once the overflow has occurred a restart of Asterisk is required to restore full SIP operation, so recovery by reload alone should not be assumed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Asterisk's PJSIP-based publish/subscribe stack (res_pjsip_pubsub), specifically in parse_simple_message_summary(), which processes the body of SIP NOTIFY messages carrying message-summary data used for Message Waiting Indication (MWI). The upstream fix changes an unbounded "%s" conversion in an sscanf call against the "message-account:" line to a width-limited "%511s", showing that attacker-controlled text from the Message-Account field was copied into a fixed 512-byte destination with no length check - a classic CWE-120 buffer copy without size validation, additionally tracked as CWE-787 out-of-bounds write. Because validation happens only when the NOTIFY body is parsed, a single oversized field overwrites adjacent stack memory, which in the reported outcome corrupts transport state and takes down SIP service, requiring an Asterisk restart rather than recovery through normal protocol handling. The exact deployment or subscription state needed for a crafted NOTIFY to reach this parser is not described in the available sources, and high attack complexity reflects that reliably landing the overflow is non-trivial.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated (AV:N/PR:N/UI:N) with availability-only impact (A:H; C/I:N); AC:H retained since sources indicate a specially crafted packet rather than a trivial trigger.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
The flaw is a classic stack buffer overflow, CWE-120 ("Buffer Copy without Checking Size of Input"), with CWE-787 (out-of-bounds write) also assigned.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity stack buffer overflow in Asterisk's SIP message handling module (res_pjsip_pubsub) can be triggered remotely by unauthenticated attackers, causing a complete denial of service that disables all SIP functionality until the service is restarted. Given Asterisk's critical role in enterprise telephony, this vulnerability threatens business continuity for voice communications and contact center operations, requiring immediate patch deployment across all affected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB