CVE-2026-57187 Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-57187?
CVE-2026-57187 is a high-severity vulnerability in asterisk, published on 26 Oct 2026.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Which versions are affected by CVE-2026-57187?
How do I fix CVE-2026-57187?
Upgrade to a fixed version.
Is CVE-2026-57187 being exploited?
There is no known exploitation of CVE-2026-57187 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-57187, GHSA-g8q2-p36q-94f6, UBUNTU-CVE-2026-57187.