A missing bounds check in the chan_unistim module’s DIALPAGE digit parsing allows an attacker to send a specially crafted packet that writes beyond the end of the phone_number buffer, resulting in an out‑of‑bounds write that crashes the Asterisk service. This loss of service can be triggered by the attacker directly and does not require authentication. The weakness is categorized as CWE‑787.

Affected are Asterisk releases prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and the corresponding Certified Asterisk builds 20.7‑cert11 and 22.8‑cert3. The vulnerability is present only when the chan_unistim module is loaded and an UNISTIM UDP port is configured and reachable. Products listed by the CNA include asterisk:asterisk and asterisk:certified-asterisk.

The CVSS score of 5.9 indicates a medium severity. No EPSS score is available, and the issue is not in the CISA KEV catalog. Exploitation requires path access to the UNISTIM UDP port and the ability to register as a phone MAC or to use an autoprovisioning route. Therefore the attack surface is limited to networks where the UNISTIM interface is exposed, but an attacker who satisfies these conditions can repeatedly crash the system, causing denial of service.