CVE-2026-57191

The record

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected packages

Related vulnerabilities

• CVE-2026-119146 ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the… CWE-120
• CVE-2026-93857 A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote… CWE-120
• CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow… CWE-120
• CVE-2026-79863 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow… CWE-120
• CVE-2026-79859 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead… CWE-120
• CVE-2026-79860 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead… CWE-120
• CVE-2026-79862 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow… CWE-120
• CVE-2026-97631 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”… CWE-120