ANT-2026-HFGGE6HR · asterisk/asterisk

stack-buffer-overflow critical

Severity Claude critical · Security research firm critical (revised; sealed as high) · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-HFGGE6HR: Stack buffer overflow in parse_simple_message_summary via unbounded sscanf %s (SIP MWI NOTIFY)

In res_pjsip_pubsub.c at line 3889, parse_simple_message_summary() uses sscanf with an unbounded %s conversion to read a field from the body of an incoming SIP NOTIFY (Event: message-summary) into a fixed-size stack buffer. The parser is reached from the network via pubsub_on_rx_notify_request → pubsub_on_rx_mwi_notify_request → parse_simple_message_summary. An attacker who can deliver a single UDP NOTIFY with an oversized body field writes fully attacker-controlled bytes past the end of the stack local (a 901-byte out-of-bounds WRITE was observed). This yields stack memory corruption and potential control-flow hijack.

Target

Project: asterisk/asterisk
Location: res/res_pjsip_pubsub.c:3889

Technical Details

res_pjsip_pubsub.c:3889 parse_simple_message_summary() calls sscanf with an unbounded %s into a fixed stack buffer while parsing the body of an incoming SIP NOTIFY (Event: message-summary). A single UDP NOTIFY whose body field exceeds the buffer length writes attacker-controlled bytes (observed 901-byte WRITE) past the stack local. Reached via pubsub_on_rx_notify_request → pubsub_on_rx_mwi_notify_request → parse_simple_message_summary.

Reproduction

Craft a SIP NOTIFY request with Event: message-summary and a body field longer than the fixed stack buffer.
Send the NOTIFY over UDP to the target's SIP endpoint.
pubsub_on_rx_notify_request dispatches to pubsub_on_rx_mwi_notify_request, which calls parse_simple_message_summary().
sscanf with unbounded %s copies the oversized field into the stack buffer, writing attacker-controlled bytes past its end.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Suggested Fix

Replace the unbounded %s in sscanf at res_pjsip_pubsub.c:3889 with a width-limited specifier (e.g., %255s) sized to the destination buffer, or rewrite using ast_strsep/ast_copy_string.

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-HFGGE6HR.

Reference: ANT-2026-HFGGE6HR
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits. The severity shown is the firm's current assessment; the report was sealed with the firm's earlier assessment of high.

Verdict: true positive
Severity: critical (revised; sealed as high)

ADVISORY

https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0

TIMELINE

Dates from discovery through public reveal.

2026-04-10 Reported to tracker
2026-05-07 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-05-29 Patch released
2026-07-20 Publicly revealed

PROVENANCE

SHA-3-512 hash:

4af0e700ec9c669355834e3145eef3b8a700d116006ebbf92fbb1219711ed32b6b53e7c3625b7c28fe84fb31aa2e9c5adcfae86b6091f267dcff34fe0dee0386

Committed 2026-05-07 00:03 PT

Revealed 2026-07-20 22:23 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-HFGGE6HR",
  "bug_class": "stack_buffer_overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-04-10T23:56:30+00:00",
  "description": "In res_pjsip_pubsub.c at line 3889, parse_simple_message_summary() uses sscanf with an unbounded %s conversion to read a field from the body of an incoming SIP NOTIFY (Event: message-summary) into a fixed-size stack buffer. The parser is reached from the network via pubsub_on_rx_notify_request → pubsub_on_rx_mwi_notify_request → parse_simple_message_summary. An attacker who can deliver a single UDP NOTIFY with an oversized body field writes fully attacker-controlled bytes past the end of the stack local (a 901-byte out-of-bounds WRITE was observed). This yields stack memory corruption and potential control-flow hijack.",
  "discovered_at": null,
  "location": "res/res_pjsip_pubsub.c:3889",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "asterisk/asterisk",
  "reproduction": [
    "1. Craft a SIP NOTIFY request with Event: message-summary and a body field longer than the fixed stack buffer.",
    "2. Send the NOTIFY over UDP to the target's SIP endpoint.",
    "3. pubsub_on_rx_notify_request dispatches to pubsub_on_rx_mwi_notify_request, which calls parse_simple_message_summary().",
    "4. sscanf with unbounded %s copies the oversized field into the stack buffer, writing attacker-controlled bytes past its end."
  ],
  "technical_details": "res_pjsip_pubsub.c:3889 parse_simple_message_summary() calls sscanf with an unbounded %s into a fixed stack buffer while parsing the body of an incoming SIP NOTIFY (Event: message-summary). A single UDP NOTIFY whose body field exceeds the buffer length writes attacker-controlled bytes (observed 901-byte WRITE) past the stack local. Reached via pubsub_on_rx_notify_request → pubsub_on_rx_mwi_notify_request → parse_simple_message_summary.",
  "title": "Stack buffer overflow in parse_simple_message_summary via unbounded sscanf %s (SIP MWI NOTIFY)",
  "vendor_severity": "high"
}