A buffer over-read occurs inside the PJSIP MWI body parser when processing an HTTP NOTIFY request, which can cause the Asterisk process to crash and become unavailable to handle further calls or SIP traffic. The vulnerability is rated as moderate, with a CVSS score of 6.5, indicating that although it does not enable code execution or data exfiltration, it can lead to a noticeable disruption of service for a user or organization that relies on the Asterisk system for voice communication. The flaw originates from insufficient bounds checking of incoming SIP message data, a classic Example of improper buffer handling.

The affected products are asterisk:asterisk and asterisk:certified-asterisk . Versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and the corresponding Certified Asterisk releases 20.7‑cert11 and 22.8‑cert3 are vulnerable. All later releases include a fix to the MWI body parser that prevents the over‑read and subsequent crash.

An attacker must be authenticated to send the specially crafted SIP NOTIFY message. Authentication can be achieved either by using a valid username/password pair or by matching the source IP address of the incoming request according to the system configuration. Because the vulnerability requires credentials, arbitrary external threat actors are limited in reach, and no publicly known exploitation tool exists. The EPSS score is not available, but given the authentication requirement the likelihood of exploitation in the wild is considered low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further supporting the assessment of a moderate overall risk.