Is CVE-2026-57198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57198 being exploited in the wild.

How severe is CVE-2026-57198?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Asterisk Certified Asterisk 20.x before 20.7-cert11, 22.x before 22.8-cert3.

How is CVE-2026-57198 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-57198?

Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57198: Asterisk T.140 RED heap buffer overflow

CVE-2026-57198 · Severity: info · Published 2026-10-27

Asterisk is an open-source telephone exchange system used to route voice and messaging calls. An authenticated attacker can trigger a heap buffer overflow in the RTP text-relay (T.140 RED) component by sending specially crafted packets, potentially crashing the system or executing arbitrary code. This vulnerability only affects deployments using the legacy chan_sip channel driver with text support enabled; the deprecated driver was removed in Asterisk 20 and later versions.

Technologies: Asterisk, Asterisk Certified Asterisk. Vendors: Asterisk.

Quick answers

Is CVE-2026-57198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57198 being exploited in the wild.
How severe is CVE-2026-57198?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Asterisk Certified Asterisk 20.x before 20.7-cert11, 22.x before 22.8-cert3.
Is there a fix for CVE-2026-57198?: Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Until then: Disable the textsupport option in chan_sip configuration, or migrate to a non-deprecated channel driver; the chan_sip driver was deprecated in Asterisk 20 and removed entirely in later versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57198 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-57198?: Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

Disable the textsupport option in chan_sip configuration, or migrate to a non-deprecated channel driver; the chan_sip driver was deprecated in Asterisk 20 and removed entirely in later versions.

Technical details

Two heap buffer overflows exist in res_rtp_asterisk.c: in red_t140_to_red() and rtp_red_buffer() functions handling T.140 RED (redundant payload) encoding. An authenticated network attacker can cause rtp_red->len array items to wrap or overflow the rtp_red->t140red_data and rtp_red->buf_data buffers by crafting malicious T.140 frames. Exploitation requires chan_sip channel driver with textsupport enabled (non-default configuration) and authentication to the PBX.

Affected products

Asterisk Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1
Asterisk Certified Asterisk 20.x before 20.7-cert11, 22.x before 22.8-cert3

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.