# CVE-2026-57189: Asterisk T.140 RED buffer overrun in RTP

Source: https://junglewise.ai/threats/cve-2026-57189-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57189 · Severity: info · Published 2026-10-27

Asterisk is an open-source phone system and VoIP toolkit used by organizations to manage voice communications. An authenticated attacker can trigger a buffer overflow in real-time transport protocol (RTP) text handling by sending specially crafted packets, potentially leading to remote code execution or crashing the phone system. The vulnerability only affects deployments using the deprecated SIP channel driver with text support enabled.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57189 being exploited in the wild.

**How severe is CVE-2026-57189?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, and 23.4.1; Certified Asterisk prior to 20.7-cert11 and 22.8-cert3.

**Is there a fix for CVE-2026-57189?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Until then: Disable the textsupport option in chan_sip channel driver configuration, or migrate to a newer Asterisk version where chan_sip has been removed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57189 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57189?** Check whether you run Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

Disable the textsupport option in chan_sip channel driver configuration, or migrate to a newer Asterisk version where chan_sip has been removed.

## Technical details

A buffer overrun exists in res_rtp_asterisk.c's handling of T.140 RED (redundant) frames during generation accumulation. An authenticated attacker can send malformed packets that cause integer wrapping in the rtp_red->len array, writing out-of-bounds in either the t140red_data or buf_data buffers. This requires the chan_sip channel driver and its textsupport option to be enabled (textsupport defaults to disabled).

## Affected products

- Asterisk Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, and 23.4.1; Certified Asterisk prior to 20.7-cert11 and 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180](https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180)
- [https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261](https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261)

## Related threats

- [Asterisk privilege escalation in ast_loggrabber via /tmp](https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk OOH323 Q.931 parser denial of service](https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk privilege escalation in REST Interface](https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony)