Log in Start free

Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-23740Asterisk vulnerable to potential privilege escalation

None 0.0

In plain English

A uncontrolled search path in asterisk from asterisk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)0.0None
Exploit odds (30 days)0.1%top 96.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14asterisk1:22.8.2+dfsg+~cs6.15.60671435-1DEBIAN-CVE-2026-23740
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2026-23740
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2026-23740
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2026-23740
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2026-23740
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2026-23740

Affected products (as reported)

VendorProductVersions
asterisk asterisk < 23.2.2< 22.8.2< 21.12.1< 20.18.2< 20.7-cert9

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N

References