# CVE-2026-57198: Asterisk T.140 RED heap buffer overflow

Source: https://junglewise.ai/threats/cve-2026-57198-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57198 · Severity: info · Published 2026-10-27

Asterisk is an open-source telephone exchange system used to route voice and messaging calls. An authenticated attacker can trigger a heap buffer overflow in the RTP text-relay (T.140 RED) component by sending specially crafted packets, potentially crashing the system or executing arbitrary code. This vulnerability only affects deployments using the legacy chan_sip channel driver with text support enabled; the deprecated driver was removed in Asterisk 20 and later versions.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk), [Asterisk Certified Asterisk](https://junglewise.ai/threats/technologies/certified-asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57198 being exploited in the wild.

**How severe is CVE-2026-57198?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Asterisk Certified Asterisk 20.x before 20.7-cert11, 22.x before 22.8-cert3.

**Is there a fix for CVE-2026-57198?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Until then: Disable the textsupport option in chan_sip configuration, or migrate to a non-deprecated channel driver; the chan_sip driver was deprecated in Asterisk 20 and removed entirely in later versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57198 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57198?** Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

Disable the textsupport option in chan_sip configuration, or migrate to a non-deprecated channel driver; the chan_sip driver was deprecated in Asterisk 20 and removed entirely in later versions.

## Technical details

Two heap buffer overflows exist in res_rtp_asterisk.c: in red_t140_to_red() and rtp_red_buffer() functions handling T.140 RED (redundant payload) encoding. An authenticated network attacker can cause rtp_red->len array items to wrap or overflow the rtp_red->t140red_data and rtp_red->buf_data buffers by crafting malicious T.140 frames. Exploitation requires chan_sip channel driver with textsupport enabled (non-default configuration) and authentication to the PBX.

## Affected products

- Asterisk Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1
- Asterisk Certified Asterisk 20.x before 20.7-cert11, 22.x before 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180](https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180)
- [https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261](https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261)

## Related threats

- [Asterisk privilege escalation in ast_loggrabber via /tmp](https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk OOH323 Q.931 parser denial of service](https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk privilege escalation in REST Interface](https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony)