CVE-2026-57192: Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-28
Weakness: CWE-125

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the `Codec2` decoder caused by a `floor/ceil sample-count mismatch`. The `codec_codec2` module must be loaded and `Codec2` must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or `source IP address matching`, establish a call using `Codec2`, and send carefully crafted `Codec2` audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected products

asterisk: before 20.20.1; from 21.0.0-pre1, < 21.12.3; from 22.0.0-pre1, < 22.10.1; from 23.0.0-pre1, < 23.4.1
asterisk certified-asterisk: before 20.7-cert11; from 22.8-cert1-pre1, < 22.8-cert3

References

Get alerted when CVE-2026-57192 or the next vulnerability affects your stack