Malformed Q.931 elements sent in an OOH323 request can trigger a crash in the chan_ooh323 particle-number parser because the CVE-2022-37325 fix was never forward‑ported from older Asterisk releases. The resulting denial of service can interrupt call handling and cause service outages. The identified weakness is a buffer overflow or similar read/write error, classified as CWE-839. The CVSS base score of 7.5 indicates a high severity of potential impact.

The vulnerability affects Asterisk publicly available releases from 21.0.0-pre1 through 21.12.3, 22.10.1, 23.4.1, and certified Asterisk 22.8-cert3. Only systems that have explicitly compiled and installed the chan_ooh323 addon driver are susceptible, and the driver’s port must be accessible from outside the internal network.

Exploitation requires that the vulnerable driver is loaded and the corresponding port is reachable over an untrusted network. An attacker can craft an abusive OOH323 request with malformed Q.931 data to force the application to crash. No public exploits have been announced, the EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score and potential for widespread denial of service mean that exposed instances pose a significant risk if left unpatched.