CVE-2026-57203

An issue was discovered in Asterisk versions 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older that causes a crash when processing certain SIP messages without a contact header. This issue occurs only when the PJSIP channel driver is used.

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2, insufficient RTCP packet validation could allow reading stale buffer contents. When combined with the 'nat' and 'symmetric_rtp' options, this could allow redirecting where Asterisk sends the next RTCP report.

app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The SMS dialplan application must be explicitly used and input not validated.

An out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch leads to a heap buffer overflow. An authenticated attacker can exploit it by sending crafted Codec2 audio packets within an established call.

An unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a crafted packet causing a stack buffer overflow and corrupting the transport, permanently disabling all SIP functionality until restart.

The PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The backend must be loaded and configured, and CELGenUserEvent must be called without validating input.

The chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix, which was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can crash Asterisk.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only ARI permissions may, under certain conditions, perform write operations via REST-over-WebSocket. The authorization bypass enables arbitrary module path loading and conditional remote code execution.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials; HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled.