CVE-2006-2898: Digium Asterisk

High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days.

The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.

Affected products

• Digium Asterisk: version 1.0.7 only; version 1.0.8 only; version 1.0.9 only; version 1.0.10 only; version 1.2.0_beta1 only; version 1.2.0_beta2 only; …

Published 2006-06-07. Last modified 2026-06-16.