Heap Buffer Overflow in Asterisk Telephony Toolkit
CVE-2026-57197
7.7HIGH
What is CVE-2026-57197?
Asterisk, the open source telephony toolkit, is vulnerable to a heap buffer overflow caused by an unbounded memcpy of corrupted OGG/Speex packet data prior to specific versions. This vulnerability can result in Asterisk crashing when attempting to process maliciously crafted audio files. Attackers can exploit this weakness by creating a corrupt audio file and making it accessible to Asterisk, requiring the user to have elevated privileges. The vulnerability is patched in the latest updates of Asterisk, and users are strongly advised to upgrade to the corrected versions.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1