CVE Tools
Track your stack

Asterisk

182 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Asterisk, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Asterisk CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Asterisk CVEs per month
MonthCVEs
2024-121
2025-010
2025-021
2025-030
2025-040
2025-052
2025-060
2025-070
2025-083
2025-091
2025-100
2025-110
2025-120
2026-010
2026-024
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-1020
2026-110

Severity

How the 182 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical117%
  • High6137%
  • Medium8752%
  • Low85%

Latest CVEs

The 15 most recently published vulnerabilities affecting Asterisk.

  1. CVE-2026-57199Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers—
  2. CVE-2026-57203Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location—
  3. CVE-2026-57190Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field—
  4. CVE-2026-57191Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing—
  5. CVE-2026-57192Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch—
  6. CVE-2026-57186Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser7.5
  7. CVE-2026-57200Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE7.5
  8. CVE-2026-57195Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication7.5
  9. CVE-2026-57202Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes8.1
  10. CVE-2026-57188Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling—
  11. CVE-2026-57189Asterisk: Possible RED T.140 Generation Accumulation OOB Write—
  12. CVE-2026-57201Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer7.5
  13. CVE-2026-57194Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk5.9
  14. CVE-2026-57198Asterisk: Possible RED T.140 Heap Buffer Overflow—
  15. CVE-2026-57185Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser6.5

Product grouping is registry-driven, with AI assist and human review. How it works