# CVE-2026-57194: Asterisk out-of-bounds write in chan_unistim DIALPAGE handling

Source: https://junglewise.ai/threats/cve-2026-57194-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57194 · Severity: medium · CVSS 5.9 · Published 2026-10-27

Asterisk is an open-source phone system and telephony toolkit used by organizations to handle call routing and VoIP communications. An attacker who can send specially crafted packets to the UNISTIM module can cause a buffer overflow that crashes the Asterisk service, leading to loss of phone system availability. The attack requires either network access to a configured UNISTIM UDP port and a valid phone MAC address, or access through an autoprovisioning path.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk), [Asterisk Certified Asterisk](https://junglewise.ai/threats/technologies/certified-asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57194 being exploited in the wild.

**How severe is CVE-2026-57194?** Medium severity, with a CVSS score of 5.9, published 27 October 2026.

**Which products and versions are affected?** Asterisk before 20.20.1, 21.12.3, 22.10.1, 23.4.1; Asterisk Certified Asterisk before 20.7-cert11, 22.8-cert3.

**Is there a fix for CVE-2026-57194?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57194 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57194?** Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

## Technical details

An out-of-bounds write vulnerability exists in the chan_unistim module's key_dial_page() function, where digit input handling fails to validate bounds on the phone_number buffer field. An attacker sending a carefully crafted incoming request packet with excessive dial digits can overflow this buffer and crash the Asterisk process. The attack requires the chan_unistim module to be loaded and configured with an accessible UNISTIM UDP port, and either valid phone MAC registration or an autoprovisioning path.

## Affected products

- Asterisk Asterisk before 20.20.1, 21.12.3, 22.10.1, 23.4.1
- Asterisk Certified Asterisk before 20.7-cert11, 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/430f423c84e4e32a462d907632b66c9793236e96](https://github.com/asterisk/asterisk/commit/430f423c84e4e32a462d907632b66c9793236e96)
- [https://github.com/asterisk/asterisk/commit/6da8e10c210d8e014c27c67235252e1dfc794446](https://github.com/asterisk/asterisk/commit/6da8e10c210d8e014c27c67235252e1dfc794446)

## Related threats

- [Asterisk privilege escalation in ast_loggrabber via /tmp](https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk OOH323 Q.931 parser denial of service](https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk privilege escalation in REST Interface](https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony)