Heap Buffer Overflow in Asterisk Telephony Toolkit Affects Various Versions
CVE-2026-57192
6MEDIUM
What is CVE-2026-57192?
Asterisk, an open-source telephony toolkit, is vulnerable to a heap buffer overflow due to an out-of-bounds write caused by a mismatch in sample counts during Codec2 audio packet processing. An attacker with valid SIP authentication can exploit this vulnerability by sending specially crafted Codec2 packets, potentially compromising the targeted endpoint. This issue is remedied in specific updates to Asterisk, including versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, as well as certified releases such as 20.7-cert11 and 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1