CVE-2026-57192

Received Received - Intake

Heap Buffer Overflow in Asterisk Codec2 Decoder

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-57192

EUVD

EUVD-2026-111396

Affected Vendors & Products

Vendor	Product	Version / Range
asterisk	asterisk	< 20.20.1
asterisk	asterisk	>= 21.0.0-pre1, < 21.12.3
asterisk	asterisk	>= 22.0.0-pre1, < 22.10.1
asterisk	asterisk	>= 23.0.0-pre1, < 23.4.1
asterisk	certified-asterisk	< 20.7-cert11
asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap buffer overflow vulnerability in Asterisk's Codec2 decoder. An authenticated attacker can exploit it by sending specially crafted Codec2 audio packets during a call. The issue occurs due to a mismatch in sample-count calculations between floor and ceil operations, leading to an out-of-bounds write. The attacker must pass SIP authentication and have Codec2 configured on the endpoint.

Detection Guidance

Detecting this vulnerability requires checking if an affected Asterisk version is running with Codec2 enabled. Inspect Asterisk logs for codec_codec2 module usage and Codec2 audio packet processing. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the Asterisk server, potentially gaining control over the telephony system. This could lead to call interception, eavesdropping, or denial of service. The attack requires authentication and specific configuration, reducing the risk but not eliminating it.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive communications, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using vulnerable Asterisk versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Asterisk to a patched version: 20.20.1, 21.12.3, 22.10.1, 23.4.1 or Certified Asterisk 20.7-cert11, 22.8-cert3. Disable Codec2 if not needed by removing codec_codec2 module configuration.

Hi! I’m here to help you understand CVE-2026-57192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70