{"metadata": {"vulnerability": "CVE-2026-57199", "count": 9, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-06-24T02:00:46.800Z", "date_only": false, "value": "2026-06-24T02:00:46.800Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-57199", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T21:59:37.626Z", "date_only": false, "value": "2026-10-27T21:59:37.626656Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117515116675008184", "record": "CVE-2026-57199", "field": "creation_timestamp", "uuid": "7ca1fc88-9004-40b4-8d7c-49390aa65056", "content": "CVE-2026-57199 Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-57199https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5https://github.com/asterisk/asterisk/commit/15c66022dc441ec63d7bd5f53cf7f35db72964behttps://github.com/asterisk/asterisk/commit/38a2059eb77a91a6b6e76eeba5875c2b96027368https://github.com/asterisk/asterisk/commit/59b74276f24ba104d859f3f05897c9b8d835a28ahttps://github.com/asterisk/asterisk/commit/60f4ef3deac6b9af30519b46c13f103264038b82https://github.com/asterisk/asterisk/commit/661d6a2fc5cc7744ab9d849ed3c73ae5066386dfhttps://github.com/asterisk/asterisk/commit/7048a3841df99e090b9d87246600373581629c98https://github.com/asterisk/asterisk/commit/f46f63bd4d33665d336cf8b5998650b915222549https://github.com/asterisk/asterisk/releases/tag/20.20.1https://github.com/asterisk/asterisk/releases/tag/21.12.3https://github.com/asterisk/asterisk/releases/tag/22.10.1https://github.com/asterisk/asterisk/releases/tag/23.4.1https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3https://github.com/asterisk/asterisk/tree/24.0.0-pre1#asterisk #certified-asterisk#CVE_2026_57199#bot", "url": "https://infosec.exchange/users/cve/statuses/117515116675008184"}, {"timestamp": "2026-10-27T22:17:00Z", "date_only": false, "value": "2026-10-27T22:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-57199", "record": "UBUNTU-CVE-2026-57199", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T22:17:00Z", "date_only": false, "value": "2026-10-27T22:17:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-57199", "record": "UBUNTU-CVE-2026-57199", "field": "modified"}, {"timestamp": "2026-10-27T22:17:27.723Z", "date_only": false, "value": "2026-10-27T22:17:27.723", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-57199", "record": "FKIE_CVE-2026-57199", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T22:17:27.723Z", "date_only": false, "value": "2026-10-27T22:17:27.723", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-57199", "record": "FKIE_CVE-2026-57199", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T23:16:05.260Z", "anchors": {"origin": {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 91402.824456, "hours": 25.38967346, "days": 1.0579030608333333, "min_seconds": 91402.824456, "max_seconds": 91402.824456, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T21:52:42.436Z", "date_only": false, "value": "2026-10-27T21:52:42.436Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-57199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T23:16:05.260Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}