🔐 CVE Alert

CVE-2026-57199

UNKNOWN 0.0

Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CWE CWE-787
Vendor asterisk
Product asterisk
Published Oct 27, 2026
Stay Ahead of the Next One

Get instant alerts for asterisk asterisk

Be the first to know when new unknown vulnerabilities affecting asterisk asterisk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

asterisk / asterisk
< 20.20.1 >= 21.0.0-pre1, < 21.12.3 >= 22.0.0-pre1, < 22.10.1 >= 23.0.0-pre1, < 23.4.1
asterisk / certified-asterisk
< 20.7-cert11 >= 22.8-cert1-pre1, < 22.8-cert3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5 github.com: https://github.com/asterisk/asterisk/commit/15c66022dc441ec63d7bd5f53cf7f35db72964be github.com: https://github.com/asterisk/asterisk/commit/38a2059eb77a91a6b6e76eeba5875c2b96027368 github.com: https://github.com/asterisk/asterisk/commit/59b74276f24ba104d859f3f05897c9b8d835a28a github.com: https://github.com/asterisk/asterisk/commit/60f4ef3deac6b9af30519b46c13f103264038b82 github.com: https://github.com/asterisk/asterisk/commit/661d6a2fc5cc7744ab9d849ed3c73ae5066386df github.com: https://github.com/asterisk/asterisk/commit/7048a3841df99e090b9d87246600373581629c98 github.com: https://github.com/asterisk/asterisk/commit/f46f63bd4d33665d336cf8b5998650b915222549 github.com: https://github.com/asterisk/asterisk/releases/tag/20.20.1 github.com: https://github.com/asterisk/asterisk/releases/tag/21.12.3 github.com: https://github.com/asterisk/asterisk/releases/tag/22.10.1 github.com: https://github.com/asterisk/asterisk/releases/tag/23.4.1 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 github.com: https://github.com/asterisk/asterisk/tree/24.0.0-pre1