2.3
LowCVSS 4.0 · from GitHub_M
CVE-2026-57199
Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
asterisk · Out-of-bounds write · CWE-787Affectedasterisk, certified-asterisk
FixNo fix listed yet.
PublishedOct 27, 21:52 · GitHub_M
ScoredOct 27 · 2.3 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inasterisk< 20.20.1–asterisk>= 21.0.0-pre1, < 21.12.3–asterisk>= 22.0.0-pre1, < 22.10.1–asterisk>= 23.0.0-pre1, < 23.4.1–certified-asterisk< 20.7-cert11–certified-asterisk>= 22.8-cert1-pre1, < 22.8-cert3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known