CVE-2026-57192

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description An authenticated attacker can trigger a heap buffer overflow via an out-of-bounds write in the Codec2 decoder. This occurs due to a floor/ceil sample-count mismatch. To exploit this, the codec codec2 module must be loaded and Codec2 must be configured on the target endpoint. The attacker needs to pass SIP authentication using a username and password or source IP address matching, establish a call using Codec2, and transmit specially crafted Codec2 audio packets.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 20.7-cert11 Update to Certified Asterisk version 22.8-cert3 As a temporary mitigation, disable the codec codec2 module or restrict the use of Codec2 on endpoints.