CVE-2026-57187

The record

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected packages

Related vulnerabilities

• CVE-2026-119338 Tesseract is an open source OCR engine. CWE-416
• CVE-2026-119332 Ladybird is a truly independent web browser. CWE-416
• CVE-2026-119116 A use-after-free and double-free issue in the SetClient command handler of the… CWE-416
• CVE-2026-119378 SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that… CWE-416
• CVE-2026-119372 SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a… CWE-416
• CVE-2026-65586 Software installed and run as a non-privileged user may conduct improper GPU system calls… CWE-416
• CVE-2026-15466 Software installed and run as a non-privileged user may conduct improper GPU system calls… CWE-416
• CVE-2026-76031 Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker… CWE-416