Log in Start free

Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M

CVE-2025-49832Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

Medium 6.5

In plain English

A medium-severity null pointer dereference in asterisk from asterisk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 55.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14asterisk1:22.5.1~dfsg+~cs6.15.60671435-1DEBIAN-CVE-2025-49832
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2025-49832
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2025-49832
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2025-49832
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2025-49832
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2025-49832

Affected products (as reported)

VendorProductVersions
asterisk asterisk < 18.26.3>= 20.00.0, < 20.15.1>= 21.00.0, < 21.10.1>= 22.00.0, < 22.5.1>= 20.7-cert6, < 20.7-cert7

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References