CVE-2026-57197

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description An unbounded memcpy of OGG/Speex packet data within the format ogg speex function can lead to a heap buffer overflow, resulting in a system crash. This occurs when the software reads a file containing corrupted Speex audio. Exploitation requires the attacker to create a malicious file and ensure it is available to the system, either through elevated privileges or by deceiving an administrator, and the system must be configured to play that file.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update Certified Asterisk to version 20.7-cert11 Update Certified Asterisk to version 22.8-cert3