🔐 CVE Alert

CVE-2026-57192

UNKNOWN 0.0

Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CWE CWE-125 CWE-131 CWE-787
Vendor asterisk
Product asterisk
Published Oct 27, 2026
Stay Ahead of the Next One

Get instant alerts for asterisk asterisk

Be the first to know when new unknown vulnerabilities affecting asterisk asterisk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

asterisk / asterisk
< 20.20.1 >= 21.0.0-pre1, < 21.12.3 >= 22.0.0-pre1, < 22.10.1 >= 23.0.0-pre1, < 23.4.1
asterisk / certified-asterisk
< 20.7-cert11 >= 22.8-cert1-pre1, < 22.8-cert3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/asterisk/asterisk/security/advisories/GHSA-qf8j-jp7h-c5hx github.com: https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079 github.com: https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56 github.com: https://github.com/asterisk/asterisk/commit/9b085d48fb66e90a0740ea59e26840421fd07acb github.com: https://github.com/asterisk/asterisk/commit/a0bc717b2261f4df7cdecc22b58a5fffbd1aa398 github.com: https://github.com/asterisk/asterisk/commit/a2f1cc611f7d0f21faa03e8535009df3041c434c github.com: https://github.com/asterisk/asterisk/commit/aa40bc599a8e628859ef1c4fc944261423ceac0d github.com: https://github.com/asterisk/asterisk/commit/d4ccfd55ffd7cf6d73a6e5cde347a7464c301006 github.com: https://github.com/asterisk/asterisk/releases/tag/20.20.1 github.com: https://github.com/asterisk/asterisk/releases/tag/21.12.3 github.com: https://github.com/asterisk/asterisk/releases/tag/22.10.1 github.com: https://github.com/asterisk/asterisk/releases/tag/23.4.1 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 github.com: https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 github.com: https://github.com/asterisk/asterisk/tree/24.0.0-pre1