low advisory October 27, 2026

Asterisk: H.323 channel driver stack buffer overflow (CVE-2026-57201)

A stack buffer overflow in the Asterisk chan_ooh323 module allows a remote attacker to crash the telephony process via a crafted H.323 packet.

Triage facts

Revision 1

Applicability: Asterisk (< 20.20.1, < 21.12.3, < 22.10.1, < 23.4.1), Certified Asterisk (< 20.7-cert11, < 22.8-cert3)
Evidence: Unknown
Severity: Low
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 27, 18:06 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

A vulnerability (CVE-2026-57201) exists in the Asterisk chan_ooh323 module's ooTrace() function. The function utilizes an unbounded vsprintf call to write data into a fixed 2048-byte stack buffer. A remote, unauthenticated attacker can trigger a crash of the Asterisk process by sending a specially crafted H.323 packet.

This vulnerability only affects deployments where the chan_ooh323 addon channel driver is explicitly compiled, installed, and exposed to the network.

Impact

Successful exploitation results in a denial-of-service (DoS) condition, crashing the Asterisk telephony process.

Recommendation

Upgrade Asterisk to version 20.20.1, 21.12.3, 22.10.1, 23.4.1 or later.
Upgrade Certified Asterisk to version 20.7-cert11, 22.8-cert3 or later.
If upgrading is not immediately possible, disable the chan_ooh323 module if it is not required for business operations.
Restrict network access to H.323 listening ports via firewall rules to ensure only trusted sources can reach the service.

Immediate actions

Patch affected Asterisk instances to the specified version

IT Operations 72h

Threat Hunt

Identify systems with the chan_ooh323 module active

T1498 medium high confidence hunt now

Data: Asterisk module configuration files (modules.conf), Asterisk CLI output (module show like ooh323)

Mitigations

Apply network firewall rules to restrict access to H.323 ports

immediate Network Engineering

CVE-2026-57201