CVE-2026-57188highCWE-787

CVE-2026-57188: falha de alta gravidade em asterisk

Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar asterisk+ Monitorar certified-asterisk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
asterisk · asteriskasterisk · certified-asterisk
CVEs relacionadas — asterisk

No mesmo produto, das mais perigosas para as menos.

CVE-2023-49294MEDIUMAsterisk Path Traversal vulnerabilityEPSS 45.3%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-42365HIGHAsterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplanEPSS 4.7%CVE-2026-57193MEDIUMAsterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)EPSS 2.0%CVE-2009-3723—CVE-2009-3723EPSS 1.2%CVE-2023-37457HIGHAsterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'EPSS 1.1%