CVE-2026-57203 is a vulnerability in Asterisk's ast_loggrabber component where a Python script is executed from the world-writable /tmp directory. This allows an attacker with shell access to place a malicious script that could be executed with elevated privileges when an administrator runs ast_loggrabber. The issue affects multiple versions of Asterisk prior to fixed releases and has been assigned a CVSS score of 6.9 (medium severity).
A SQL Injection vulnerability exists in Asterisk's PostgreSQL and TDS/MSSQL Channel Event Log backends (cel_pgsql and cel_tds) prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. This occurs when untrusted data is passed to the CELGenUserEvent dialplan application without validation, allowing arbitrary SQL execution. The issue requires that the vulnerable backend is loaded and configured and that the dialplan calls CELGenUserEvent without proper input validation. Fixed versions have been released to address this vulnerability.
CVE-2026-57200 is a path traversal vulnerability in Asterisk affecting versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3. An authenticated attacker with read-only Asterisk REST Interface (ARI) credentials may exploit this to perform write operations via REST-over-WebSocket, leading to arbitrary module path loading and potential remote code execution. The vulnerability requires the Asterisk HTTP server to be enabled and reachable, which is disabled and bound to localhost by default. This issue has been fixed in the specified versions.
CVE-2026-57195 is a high-severity vulnerability in Asterisk's Manager Interface (AMI) that allows an unauthenticated attacker to cause a denial of service via a NULL pointer dereference. This occurs when Digest Authentication is used over HTTP and the HTTP server, AMI, and AMI HTTP access are all enabled. The HTTP server binds to 127.0.0.1 by default, limiting exposure. The issue is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.
CVE-2026-57189 is an out-of-bounds write vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when its textsupport option is enabled. An authenticated attacker can trigger a T.140 RED out-of-bounds write during generation accumulation, potentially leading to remote code execution or a crash. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It arises from an unbounded vsprintf write into a fixed 2048-byte buffer in the ooTrace() trace-logging function. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
CVE-2026-57194 is an out-of-bounds write vulnerability in the chan_unistim module of Asterisk, an open source telephony toolkit. The flaw allows an attacker to overflow the phone_number field and crash the system by sending a crafted incoming request packet. Exploitation requires the chan_unistim module to be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent provisioning path. This vulnerability affects multiple Asterisk versions prior to fixed releases and has a medium severity rating with a CVSS score of 5.9.
CVE-2026-57198 is a heap-based buffer overflow vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when the textsupport option is enabled. An authenticated attacker can exploit this flaw by sending crafted T.140 RED packets, potentially causing remote code execution or crashing the system. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in multiple Asterisk versions including 20.20.1, 21.12.3, 22.10.1, and 23.4.1.
CVE-2026-57185 is a buffer over-read vulnerability in the PJSIP MWI body parser of Asterisk, an open source telephony toolkit. An authenticated attacker can cause a crash by sending a crafted SIP NOTIFY request. Authentication can be via username/password or source IP address matching. The issue affects multiple versions prior to fixed releases and has been addressed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding Certified Asterisk releases.
CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
CVE-2026-57184 is an out-of-bounds read vulnerability in the Asterisk telephony toolkit's chan_ooh323 addon channel driver. This flaw exists in the Q.931 information-element parser due to insufficient bounds checking. An unauthenticated attacker can exploit this by sending crafted setup packets to cause a crash. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. Fixes are available in the stated versions.
CVE-2026-57193 is a vulnerability in the Asterisk telephony toolkit's LDAP realtime driver (res_config_ldap) that allows LDAP filter injection via a crafted SIP username. This can enable an unauthenticated attacker to perform arbitrary LDAP queries and potentially disclose information. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The res_config_ldap module must be enabled and configured to access an LDAP server for the issue to be exploitable. Fixed versions are available.