CVE-2026-57189

The record

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.

Affected packages

Related vulnerabilities

• CVE-2026-78402 Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys… CWE-787
• CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. CWE-787
• CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw… CWE-787
• CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the… CWE-787
• CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image… CWE-787
• CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the… CWE-787
• CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image… CWE-787
• CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-787