diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 3d8b0b725031b7c975157df1662c32f78a034cea..61480d6dd22e0e2b7067a7c9b5bcd673b19b59bc 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -14454,8 +14454,8 @@ static void state_notify_build_xml(struct state_notify_data *data, int full, con
 		if (data->state > 0 && (data->state & AST_EXTENSION_RINGING) && sip_cfg.notifyringing) {
 			/* Twice the extension length should be enough for XML encoding */
 			char local_display[AST_MAX_EXTENSION * 2];
+			char remote_display[AST_MAX_EXTENSION * 2];
 			char *local_target = ast_strdupa(mto);
-			const char *remote_display = exten;
 			/* It may seem odd to base the remote_target on the To header here,
 			 * but testing by reporters on issue ASTERISK-16735 found that basing
 			 * on the From header would cause ringing state hints to not work
@@ -14467,6 +14467,7 @@ static void state_notify_build_xml(struct state_notify_data *data, int full, con
 			char *remote_target = ast_strdupa(mto);
 
 			ast_xml_escape(exten, local_display, sizeof(local_display));
+			ast_xml_escape(exten, remote_display, sizeof(remote_display));
 
 			/* There are some limitations to how this works.  The primary one is that the
 			   callee must be dialing the same extension that is being monitored.  Simply dialing
@@ -14497,8 +14498,9 @@ static void state_notify_build_xml(struct state_notify_data *data, int full, con
 					remote_target = ast_alloca(need);
 					snprintf(remote_target, need, "sip:%s@%s", connected_num, p->fromdomain);
 
-					remote_display = ast_strdupa(S_COR(ast_channel_connected(callee)->id.name.valid,
-						ast_channel_connected(callee)->id.name.str, ""));
+					ast_xml_escape(S_COR(ast_channel_connected(callee)->id.name.valid,
+							     ast_channel_connected(callee)->id.name.str, ""),
+						       remote_display, sizeof(remote_display));
 
 					ast_channel_unlock(callee);
 					callee = ast_channel_unref(callee);