Read the docs
TI-2026-81424 Aliases CVE-2026-57197

Heap buffer overflow in Asterisk OGG/Speex file playback

Priority LOW 36CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Asterisk before 20.20.1, 21.12.3, 22.10.1 and 23.4.1 and Certified Asterisk before 20.7-cert11 and 22.8-cert3 are affected by a heap buffer overflow in the OGG/Speex reader (format_ogg_speex). An unbounded memcpy of Speex packet data lets corrupted audio overwrite heap memory (CWE-122), crashing Asterisk. An attacker must place the file where Asterisk can read it, with elevated privileges or an administrator's help, and Asterisk must be set to play it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00531 45th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 20.20.1, 21.12.3, 22.10.1 +1certified-asterisk (asterisk): 20.7-cert11, 22.8-cert3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.120.20.1, 21.12.3, 22.10.1, 23.4.1Patch availableCNA
asteriskcertified-asteriskbefore 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert320.7-cert11, 22.8-cert3Patch availableCNA
  • asterisk Vendorasterisk Affected before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1 Patch available CNA
  • certified-asterisk Vendorasterisk Affected before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 20.7-cert11, 22.8-cert3 Patch available CNA

Remediation

Upgrade Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1, and Certified Asterisk to 20.7-cert11 or 22.8-cert3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA asterisk (asterisk) Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1
  • Fix · CNA certified-asterisk (asterisk) Fixed in 20.7-cert11, 22.8-cert3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-57197
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-11-02 Affected versions changed · Red Hat
  4. 2026-11-02 CVSS score added · Red Hat
  5. 2026-11-02 CISA SSVC decision points changed

References

Other 15

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences