Asterisk: Stack buffer overflow in MWI NOTIFY parsing
Summary
Asterisk, an open source PBX and telephony toolkit, has a stack buffer overflow in the res_pjsip_pubsub module. It is triggered when parsing the Message-Account field of an MWI NOTIFY message, because an unbounded sscanf call writes past the destination buffer. An unauthenticated remote attacker can send a crafted SIP packet, which corrupts the transport and permanently disables all SIP functionality until Asterisk is restarted.
Affected
- Asterisk before 20.20.1
- Asterisk 21.0.0-pre1 to before 21.12.3
- Asterisk 22.0.0-pre1 to before 22.10.1
- Asterisk 23.0.0-pre1 to before 23.4.1
- Certified Asterisk before 20.7-cert11
- Certified Asterisk 22.8-cert1-pre1 to before 22.8-cert3
- Unknown: whether the 24.0.0-pre1 development branch is affected
Fixed in
- Asterisk 20.20.1
- Asterisk 21.12.3
- Asterisk 22.10.1
- Asterisk 23.4.1
- Certified Asterisk 20.7-cert11
- Certified Asterisk 22.8-cert3
Workaround
Unknown. No vendor-documented workaround was found. Restricting SIP signalling to known trunk and phone addresses at the firewall may reduce exposure.
Exploitation
- No known exploitation in the wild in the sources reviewed.
- No public proof of concept found.
- Patched code has likely been public since the advisory was published on 25 Jun 2026, so n-day exploit development is plausible.
Our recommendation
- Upgrade to a fixed release listed above, and plan a maintenance window because a restart is required.
- Restrict SIP ports so they are not reachable from the whole internet.
- Check whether your Asterisk or Certified Asterisk version is affected and whether your distribution package has been fixed.
- Monitor SIP traffic and service availability for unusual failures.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-589g-qgf8-m6mx github.com
- Fix commit 7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0 github.com
- Asterisk 20.20.1 release github.com
- Asterisk 21.12.3 release github.com
- Asterisk 22.10.1 release github.com
- Asterisk 23.4.1 release github.com
- Certified Asterisk 20.7-cert11 release github.com
- Certified Asterisk 22.8-cert3 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:51.
Original description (NVD)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
NVD references (15)
- https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528
- https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b
- https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0
- https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b
- https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd
- https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a
- https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
- https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.