Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a "T.140 RED" out-of-bounds write during "generation accumulation" using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The "chan_sip" channel driver must be installed and configured, and its "textsupport" option must be enabled; "textsupport" defaults to no. "The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions." Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required "chan_sip" driver was removed there.