{"id":"CVE-2026-23740","summary":"Asterisk vulnerable to potential privilege escalation","details":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.","aliases":["GHSA-xpc6-x892-v83c"],"modified":"2026-08-12T03:51:12.522504403Z","published":"2026-02-06T16:43:41.330Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-427"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23740.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23740.json"},{"type":"ADVISORY","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23740"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"0"},{"fixed":"d49c5d454f42fc11da7631bea496c66c6473798e"},{"introduced":"12da95e53ff42287ad69d6d5922e06c3d62010ac"},{"fixed":"f0da54060ab01d91d9ddb78d1e5851bb489bbc90"},{"introduced":"8e4a09f71162ebc1e4bb2159dfc638aa2328047c"},{"fixed":"ce9bf76d69f960dcce55f09bec064248e0ec82dc"},{"introduced":"3bb594c9ca712342edeba7d0610af12c08929737"},{"fixed":"65a52c176730f95b3377e8105c189e580e61f926"},{"introduced":"fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0"},{"last_affected":"356f4d00876f07f6094f8d45a49229f29a3d59f0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"20.18.2"},{"introduced":"21.0.0"},{"fixed":"21.12.1"},{"introduced":"22.0.0"},{"fixed":"22.8.2"},{"introduced":"23.0.0"},{"fixed":"23.2.2"},{"introduced":"13.13.0-NA"},{"last_affected":"13.13.0-NA"},{"introduced":"13.13.0-rc1"},{"last_affected":"13.13.0-rc1"},{"introduced":"13.13.0-rc2"},{"last_affected":"13.13.0-rc2"},{"introduced":"16.8-cert1\\-rc1"},{"last_affected":"16.8-cert1\\-rc1"},{"introduced":"16.8-cert1\\-rc2"},{"last_affected":"16.8-cert1\\-rc2"},{"introduced":"16.8-cert1\\-rc3"},{"last_affected":"16.8-cert1\\-rc3"},{"introduced":"16.8-cert1\\-rc4"},{"last_affected":"16.8-cert1\\-rc4"},{"introduced":"16.8-cert1\\-rc5"},{"last_affected":"16.8-cert1\\-rc5"},{"introduced":"16.8-cert10"},{"last_affected":"16.8-cert10"},{"introduced":"16.8-cert11"},{"last_affected":"16.8-cert11"},{"introduced":"16.8-cert12"},{"last_affected":"16.8-cert12"},{"introduced":"16.8-cert13"},{"last_affected":"16.8-cert13"},{"introduced":"16.8-cert14"},{"last_affected":"16.8-cert14"},{"introduced":"16.8-cert4\\-rc1"},{"last_affected":"16.8-cert4\\-rc1"},{"introduced":"16.8-cert4\\-rc2"},{"last_affected":"16.8-cert4\\-rc2"},{"introduced":"16.8-cert4\\-rc3"},{"last_affected":"16.8-cert4\\-rc3"},{"introduced":"16.8-cert4\\-rc4"},{"last_affected":"16.8-cert4\\-rc4"},{"introduced":"16.8.0-NA"},{"last_affected":"16.8.0-NA"},{"introduced":"18.9-NA"},{"last_affected":"18.9-NA"},{"introduced":"18.9-cert1"},{"last_affected":"18.9-cert1"},{"introduced":"18.9-cert1\\-rc1"},{"last_affected":"18.9-cert1\\-rc1"},{"introduced":"18.9-cert10"},{"last_affected":"18.9-cert10"},{"introduced":"18.9-cert11"},{"last_affected":"18.9-cert11"},{"introduced":"18.9-cert12"},{"last_affected":"18.9-cert12"},{"introduced":"18.9-cert13"},{"last_affected":"18.9-cert13"},{"introduced":"18.9-cert14"},{"last_affected":"18.9-cert14"},{"introduced":"18.9-cert15"},{"last_affected":"18.9-cert15"},{"introduced":"18.9-cert16"},{"last_affected":"18.9-cert16"},{"introduced":"18.9-cert2"},{"last_affected":"18.9-cert2"},{"introduced":"18.9-cert3"},{"last_affected":"18.9-cert3"},{"introduced":"18.9-cert4"},{"last_affected":"18.9-cert4"},{"introduced":"18.9-cert5"},{"last_affected":"18.9-cert5"},{"introduced":"18.9-cert6"},{"last_affected":"18.9-cert6"},{"introduced":"18.9-cert7"},{"last_affected":"18.9-cert7"},{"introduced":"18.9-cert8"},{"last_affected":"18.9-cert8"},{"introduced":"18.9-cert8\\-rc1"},{"last_affected":"18.9-cert8\\-rc1"},{"introduced":"18.9-cert8\\-rc2"},{"last_affected":"18.9-cert8\\-rc2"},{"introduced":"18.9-cert9"},{"last_affected":"18.9-cert9"},{"introduced":"20.7-cert1"},{"last_affected":"20.7-cert1"},{"introduced":"20.7-cert1\\-rc1"},{"last_affected":"20.7-cert1\\-rc1"},{"introduced":"20.7-cert1\\-rc2"},{"last_affected":"20.7-cert1\\-rc2"},{"introduced":"20.7-cert2"},{"last_affected":"20.7-cert2"},{"introduced":"20.7-cert3"},{"last_affected":"20.7-cert3"},{"introduced":"20.7-cert4"},{"last_affected":"20.7-cert4"},{"introduced":"20.7-cert5"},{"last_affected":"20.7-cert5"},{"introduced":"20.7-cert6"},{"last_affected":"20.7-cert6"},{"introduced":"20.7-cert7"},{"last_affected":"20.7-cert7"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:13.13.0:-:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert10:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert11:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert12:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert13:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert14:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert12:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert13:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert14:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert15:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert16:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*","cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*"]}}],"versions":["13.13.0-NA","13.13.0-rc1","13.13.0-rc2","16.8-cert10","16.8-cert11","16.8-cert12","16.8-cert13","16.8-cert14","16.8-cert1\\-rc1","16.8-cert1\\-rc2","16.8-cert1\\-rc3","16.8-cert1\\-rc4","16.8-cert1\\-rc5","16.8-cert4\\-rc1","16.8-cert4\\-rc2","16.8-cert4\\-rc3","16.8-cert4\\-rc4","16.8.0-NA","18.9-NA","18.9-cert1","18.9-cert10","18.9-cert11","18.9-cert12","18.9-cert13","18.9-cert14","18.9-cert15","18.9-cert16","18.9-cert1\\-rc1","18.9-cert2","18.9-cert3","18.9-cert4","18.9-cert5","18.9-cert6","18.9-cert7","18.9-cert8","18.9-cert8\\-rc1","18.9-cert8\\-rc2","18.9-cert9","20.7-cert1","20.7-cert1\\-rc1","20.7-cert1\\-rc2","20.7-cert2","20.7-cert3","20.7-cert4","20.7-cert5","20.7-cert6","20.7-cert7","certified-22.8-cert1-pre1","22.8.2","certified-22.8-cert1","certified-22.8-cert1-rc1","23.2.1","22.8.1","21.12.0","20.18.1","23.2.0","22.8.0","20.18.0","20.18.0-rc1","22.8.0-rc1","23.2.0-rc1","23.1.0","22.7.0","20.17.0","certified-20.7-cert7","22.7.0-rc2","21.12.0-rc2","23.1.0-rc2","20.17.0-rc2","23.1.0-rc1","22.7.0-rc1","21.12.0-rc1","20.17.0-rc1","22.6.0","23.0.0","21.11.0","20.16.0","22.6.0-rc2","21.11.0-rc2","20.16.0-rc2","22.6.0-rc1","21.11.0-rc1","20.16.0-rc1","20.15.0","20.15.0-rc3","20.15.0-rc1","20.15.0-rc2","20.15.1","20.15.2","20.14.0","21.10.0","21.10.0-rc3","21.10.0-rc1","21.10.0-rc2","21.10.1","21.10.2","21.9.0","22.5.0","22.5.0-rc3","22.5.0-rc1","22.5.0-rc2","22.5.1","22.5.2","22.4.0","certified-20.7-cert6","certified-20.7-cert5","certified-20.7-cert4","22.4.0-rc1","21.9.0-rc1","20.14.0-rc1","22.3.0","21.8.0","20.13.0","22.3.0-rc1","21.8.0-rc1","20.13.0-rc1","22.2.0","21.7.0","20.12.0","22.2.0-rc2","21.7.0-rc2","20.12.0-rc2","22.2.0-rc1","21.7.0-rc1","20.12.0-rc1","22.1.1","21.6.1","20.11.1","22.1.0","21.6.0","certified-20.7-cert3","20.11.0","22.1.0-rc1","21.6.0-rc1","20.11.0-rc1","22.0.0","21.5.0","20.10.0","20.10.0-rc2","21.5.0-rc2","21.5.0-rc1","20.10.0-rc1","21.4.3","20.9.3","certified-20.7-cert2","21.4.2","20.9.2","21.4.1","20.9.1","certified-20.7-cert1","20.9.0","21.4.0","21.4.0-rc1","20.9.0-rc1","certified-20.7-cert1-rc2","21.3.1","20.8.1","21.3.0","20.8.0","21.3.0-rc1","20.8.0-rc1","certified-20.7-cert1-rc1","certified-20.7-cert1-pre1","20.7.0","21.2.0","21.2.0-rc2","20.7.0-rc2","20.7.0-rc1","21.2.0-rc1","21.1.0","20.6.0","21.1.0-rc2","20.6.0-rc2","21.1.0-rc1","20.6.0-rc1","21.0.2","20.5.2","20.5.1","21.0.1","21.0.0","20.5.0","20.5.0-rc1","20.4.0","20.4.0-rc2","20.4.0-rc1","20.3.1","20.3.0","20.3.0-rc1","20.2.1","20.2.0","20.2.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23740.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N"}]}