Asterisk PBX is vulnerable to an unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field. An unauthenticated attacker can send a carefully crafted packet that triggers a stack buffer overflow, corrupting the underlying SIP transport and permanently disabling all SIP functionality until the Asterisk daemon is restarted. The flaw is a classic buffer copy without bound checking (CWE-120) and an out‑of‑bounds write (CWE-787).

The flaw affects Asterisk and Certified Asterisk, impacting all versions released prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified 20.7‑cert11, 22.8‑cert3. The specified releases 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified 20.7‑cert11, 22.8‑cert3 contain the fix.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, over the SIP network, and requires no authentication; a single crafted packet sent to the Asterisk server can trigger the overflow. Given the lack of authentication checks and the potential for permanent service disruption, the likelihood of exploitation is high and the risk to operating telecom infrastructure is significant.