A single authenticated user can send specially crafted SIP packets that trigger an out-of-bounds write in the T.140 RED generation accumulation code. The vulnerability is an instance of a buffer over-read/write (CWE-787) and can cause the Asterisk process to crash or, if exploitation succeeds, allow arbitrary code execution. The impact is limited to the system on which the vulnerable Asterisk instance runs and requires the attacker to authenticate and send packets to a channel using the deprecated chan_sip driver with textsupport enabled.

The vulnerability affects open‑source Asterisk phone servers and certified builds. The affected product lines include the main Asterisk binary tracked under asterisk:asterisk and the certified branches at asterisk:certified-asterisk. All releases up to and including 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as the certified 20.7‑cert11 and 22.8‑cert3 builds, contain the unpatched code. The flaw only exists when the chan_sip driver, which was deprecated in Asterisk 20 and removed thereafter, is installed and the textsupport option is enabled—textsupport defaults to disabled.

The CVSS score of 2.3 indicates a low overall severity, and the EPSS score is not available, so the likelihood of widespread exploitation is undetermined. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to authenticate to the Asterisk system, have the chan_sip driver active, and be able to deliver malicious SIP payloads that target the RED packet handling logic. Because the driver is deprecated in later releases, the attack surface is reduced for users who have already migrated away from chan_sip or who run versions newer than Asterisk 20 that no longer include the driver.