Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

{
  "id": "bf90c8b0378fcc853e4ba86fbce649071f26fa7a717776fff66eb135af7a5021",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-57194",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk",
    "summary": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.",
    "evidence": "cve:CVE-2026-57194",
    "products": [
      {
        "name": {
          "value": "asterisk",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "certified-asterisk",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-57194",
      "aliases": [
        "CVE-2026-57194"
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 5.9,
            "attackVector": "NETWORK",
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "integrityImpact": "NONE",
            "userInteraction": "NONE",
            "attackComplexity": "HIGH",
            "availabilityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "NONE"
          }
        }
      ],
      "affected": [
        {
          "vendor": "asterisk",
          "product": "asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "< 20.20.1"
            },
            {
              "status": "affected",
              "version": ">= 21.0.0-pre1, < 21.12.3"
            },
            {
              "status": "affected",
              "version": ">= 22.0.0-pre1, < 22.10.1"
            },
            {
              "status": "affected",
              "version": ">= 23.0.0-pre1, < 23.4.1"
            }
          ]
        },
        {
          "vendor": "asterisk",
          "product": "certified-asterisk",
          "versions": [
            {
              "status": "affected",
              "version": "< 20.7-cert11"
            },
            {
              "status": "affected",
              "version": ">= 22.8-cert1-pre1, < 22.8-cert3"
            }
          ]
        }
      ],
      "modified": "2026-10-27T16:52:47.225Z",
      "provider": "cve",
      "references": [
        "https://github.com/asterisk/asterisk/security/advisories/GHSA-3g56-cgrh-95p5",
        "https://github.com/asterisk/asterisk/commit/430f423c84e4e32a462d907632b66c9793236e96",
        "https://github.com/asterisk/asterisk/commit/6da8e10c210d8e014c27c67235252e1dfc794446",
        "https://github.com/asterisk/asterisk/commit/6f414ec771eaa3318a4b2d28f70fa387196ae283",
        "https://github.com/asterisk/asterisk/commit/ce6e2233599b76bc30c33b4816b15609c8ddc8b6",
        "https://github.com/asterisk/asterisk/commit/d803b5370b05f39a6241b2556eb9894b02148e6a",
        "https://github.com/asterisk/asterisk/commit/fc3a1cb3c386c962bfca8cd9d533d1390d4ad933",
        "https://github.com/asterisk/asterisk/commit/ff65e4b0867bee12cdcb3a6219b976ee7ee08963",
        "https://github.com/asterisk/asterisk/releases/tag/20.20.1",
        "https://github.com/asterisk/asterisk/releases/tag/21.12.3",
        "https://github.com/asterisk/asterisk/releases/tag/22.10.1",
        "https://github.com/asterisk/asterisk/releases/tag/23.4.1",
        "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11",
        "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3",
        "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
          "shortName": "GitHub_M",
          "dateUpdated": "2026-10-27T16:52:47.225Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-57194",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 394474,
  "published_at": "2026-10-27T16:52:47.225+00:00"
}