CVE-2026-57192
Description
A flaw was found in Asterisk. An authenticated remote attacker can cause a Denial of Service (DoS) via a heap-based buffer overflow in the Codec 2 audio decoder. Due to a sample-count calculation mismatch, an attacker can establish a call and transmit specially crafted audio packets to corrupt memory and crash the service.
Statement
This vulnerability is rated Moderate because successful exploitation requires prior SIP authentication or trusted source IP verification, and the blast radius is primarily limited to service termination. In typical deployments, the Codec 2 translation module is not loaded by default and requires explicit configuration on the target endpoint. Consequently, telephony environments that do not negotiate Codec 2 or restrict authenticated endpoint access to trusted callers face minimal exposure.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
