A stack buffer overflow can arise in the H.323 `ooTrace()` tracing function of Asterisk when unbounded `vsprintf` writes into a fixed 2048-byte buffer; a specially crafted packet may trigger the overflow and cause the Asterisk process to crash, disrupting telephone services. The weakness is an out-of-bounds write (CWE-787).

Vendors: Asterisk and Certified Asterisk. Products: The `chan_ooh323` channel driver, which must be explicitly compiled and installed. Affected versions are those released before the security fix – Asterisk 20.20.0 and earlier, 21.12.2 and earlier, 22.10.0 and earlier, 23.4.0 and earlier, and Certified Asterisk 20.7-cert10 and earlier, 22.8-cert2 and earlier. All releases prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11, and 22.8-cert3 are vulnerable.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring that the `chan_ooh323` addon be installed and its port be publicly reachable – a condition that is uncommon in default setups but possible when H.323 is enabled. An attacker can send a crafted H.323 packet to the exposed port, trigger the overflow, and force the Asterisk process to crash, resulting in denial of service for all callers. The lack of a current KEV listing indicates no known widespread exploitation, but the high CVSS and remote nature warrant prompt remediation.