EUVD-2026-111403Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authorized access to SMS path (PR:L)
-
DeliverySend SMS with oversized length/header fields
-
ExploitReach unvalidated SMS dialplan application
-
ExecutionTrigger out-of-bounds write in unpacksms7/8/16 / unpackaddress
-
ImpactCorrupt memory or crash Asterisk
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the administrator has explicitly deployed the SMS dialplan application (meaningful only when routing calls to/from analog devices) AND has not ensured that the data passed to the application is valid - both stated as preconditions in the vendor advisory. The attacker must then supply SMS protocol data whose length/user-data-header fields exceed the fixed in-struct buffers (udh, ud, originating/destination address). Limiting factors that reduce realistic risk: the SMS app is a non-default, narrowly-used feature; PR:L means some authenticated or authorized access to the SMS path is needed (not fully anonymous); AT:P indicates an additional attack requirement must be satisfied; and the confirmed impact is a crash / memory corruption (availability), with no confidentiality or integrity impact scored. |
| Impact | This is a low-priority issue, not a high-CVSS-but-overrated one - every signal points the same way. The vendor CVSS 4.0 base score is 2.3 and the vuln.today decision label is 'monitor' (not act_now or emergency). The 4.0 vector shows AV:N/AC:L but AT:P (a specific attack requirement must hold) and PR:L (authenticated), with impact limited to VA:L - no confidentiality or integrity impact, only partial availability (a crash/memory corruption). There is no CISA KEV listing and no EPSS score was supplied, so widespread or automated exploitation is not indicated. The GitHub references are the vendor advisory, fix commits and release tags - fix code, not exploit code - so no public exploit is identified. The dominant risk limiter is configuration: the SMS dialplan application is only used for routing to/from analog devices and must be explicitly deployed, and the administrator must additionally have failed to validate data passed to it. The main point worth flagging is a scope mismatch to verify operationally: the CVSS shows a network vector, but exploitation realistically requires reaching the SMS dialplan app with attacker-influenced SMS protocol data, which depends on how the telephony/analog path is exposed - confirm the actual exposure of the SMS path in your deployment. |
| Exploit ScenarioDerived | On an Asterisk server whose dialplan explicitly invokes the SMS application (used for analog-device SMS routing) without validating inbound data, an attacker who can feed SMS protocol data submits a message whose SMS length/header fields exceed the fixed in-struct buffers, causing an out-of-bounds write in the unpacksms/unpackaddress routines that corrupts memory or crashes Asterisk. Given PR:L, this requires some authenticated/authorized access to the SMS path. No public exploit is identified at time of analysis - the available references are vendor fix commits and the GHSA advisory, not proof-of-concept code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Memory corruption and denial of service in Asterisk's optional SMS dialplan application can be triggered when malformed SMS protocol data supplies length or user-data-header fields that overflow fixed in-struct buffers in app_sms.c. Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, and Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier are affected; exploitation requires the SMS application to be explicitly deployed (meaningful mainly for analog-device routing) and requires some authorized access to the SMS path, with the advisory also requiring that administrators have not ensured the data passed to the application is valid. The vendor has released fixed versions, the confirmed impact is a crash or memory corruption affecting availability, and no public exploit or active exploitation is identified at time of analysis, so the priority is monitor.
RemediationAI
Apply the vendor-released patch by upgrading to the fixed release for each branch: Asterisk 20.x to 20.20.1, 21.x to 21.12.3, 22.x to 22.10.1, 23.x to 23.4.1, and Certified Asterisk to 20.7-cert11 or 22.8-cert3. The advisory and release references are at https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5, https://github.com/asterisk/asterisk/releases/tag/20.20.1, https://github.com/asterisk/asterisk/releases/tag/21.12.3, https://github.com/asterisk/asterisk/releases/tag/22.10.1, https://github.com/asterisk/asterisk/releases/tag/23.4.1, https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11, and https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3. If an immediate upgrade is not possible, reduce exposure according to the advisory's preconditions by removing the SMS application from the dialplan where it is not required (side effect: analog-device SMS routing is disabled) and by ensuring that data passed to the application is valid; these measures reduce exposure but the vendor fixed releases are the complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-787 out-of-bounds write in Asterisk's apps/app_sms.c. The SMS parsing routines unpacksms7, unpacksms8, unpacksms16, unpacksms, and unpackaddress copy externally controlled SMS length and user-data-header values into fixed in-struct buffers (the user-data-header buffer udh, the user-data buffer ud, and originating/destination address buffers) without sufficient bounds checks. The upstream commits add size arguments and bounds tracking, passing ARRAY_LEN(h->udh) and ARRAY_LEN(h->ud) from sms_handleincoming and checking output pointers and stored header lengths against buffer ends. This is not a default attack surface: the SMS dialplan application must be explicitly configured by the administrator, it is useful when routing calls to or from analog devices, and the advisory states the administrator must not have taken measures to ensure data passed to the application is valid. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating a high-complexity attack requiring some authorized access to the SMS path and an additional attack precondition, with availability-only impact; the CPE entries cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:* and cpe:2.3:a:asterisk:certified-asterisk:*:*:*:*:*:*:*:* identify the affected product families.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Exploitation depends on the non-default SMS app being deployed and fed unvalidated data (attacker-uncontrolled preconditions) so AC:H and PR:L; confirmed impact is a crash/memory corruption, hence A:L with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the SMS dialplan application, which is useful when routing calls to or from analog devices, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB