Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sqgd-ykvk-2qay
Vulnerability ID VCID-sqgd-ykvk-2qay
Aliases CVE-2014-8416
Summary Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.
Status Published
Exploitability 0.5
Weighted Severity 4.5
Risk 2.2
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
epss 0.01066 https://api.first.org/data/v1/epss?cve=CVE-2014-8416
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2014-8416
Reference id Reference type URL
http://downloads.asterisk.org/pub/security/AST-2014-016.html
https://api.first.org/data/v1/epss?cve=CVE-2014-8416
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8416
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
CVE-2014-8416 https://nvd.nist.gov/vuln/detail/CVE-2014-8416
No exploits are available.
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2014-8416
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.77637
EPSS Score 0.01066
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:31:33.067043+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0