Asterisk, the open‑source private‑branch exchange, suffers a heap buffer overflow in the chan_sip channel driver when an authenticated attacker sends carefully crafted T.140 RED packets. The vulnerability originates from an unchecked write into a heap buffer, classified as CWE-122, and can allow remote code execution or cause the Asterisk server to crash.

Affected are installations of Asterisk and Certified Asterisk that include the chan_sip driver with the textsupport option enabled. Vulnerable releases are 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7‑cert11 and 22.8‑cert3. The chan_sip driver was deprecated in version 20 and removed in later tracks, but the advisory still lists newer tracks, leading to potential confusion about the true scope.

The CVSS score of 2.3 reflects a low severity assessment, and the EPSS score is not available, indicating limited observed exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the SIP interface and to have textsupport enabled, after which the attacker could achieve remote code execution or crash the system.