CVE-2026-57186

highpriority · track · 0DE

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 7.5 · high

Is it mine?

12 products

Check your exposure

Who says so?

1 sources

cert_bund

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 3.6

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-839USprimary

affected products (12)

Products and version ranges known to be affected.

Digium Certified Asterisk <20.7-cert11all versionscert_bundDE
Digium Certified Asterisk <22.8-cert3all versionscert_bundDE
Open Source Asterisk <20.20.1all versionscert_bundDE
Open Source Asterisk <21.12.3all versionscert_bundDE
Open Source Asterisk <22.10.1all versionscert_bundDE
Open Source Asterisk <23.4.1all versionscert_bundDE
Digium Certified Asterisk< 20.7-cert11cert_bundDE
Digium Certified Asterisk< 22.8-cert3cert_bundDE
Open Source Asterisk< 20.20.1cert_bundDE
Open Source Asterisk< 21.12.3cert_bundDE
Open Source Asterisk< 22.10.1cert_bundDE
Open Source Asterisk< 23.4.1cert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2094Digium Certified Asterisk: Mehrere SchwachstellenDeutsch2026-06-25csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Digium Certified Asterisk und Asterisk ausnutzen, um Speicherfehler und Denial-of-Service-Zustände auszulösen, Informationen offenzulegen, Sitzungen zu übernehmen, Sicherheitsmechanismen und Berechtigungen zu umgehen, beliebige SQL- oder LDAP-Abfragen auszuführen sowie unter bestimmten Voraussetzungen beliebigen Programmcode auszuführen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-10-27modified 2026-10-27

related (14)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2012-1142US	high9.3	3.77% (90th)	—	2012-04-25
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and me…
CVE-2021-31227US	high7.5	1.68% (77th)	—	2021-08-19
An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to an incorrect signed integer…
CVE-2019-20925US	high7.5	1.68% (77th)	—	2020-11-24
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. Th…
CVE-2023-0425US	high7.5	0.47% (41st)	—	2023-08-07
ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance.…
CVE-2023-22854US	high7.5	0.60% (49th)	—	2023-02-13
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient rest…

+9 more

references (11) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan