CVE-2026-57197
Description
A flaw was found in Asterisk. A heap buffer overflow in the format_ogg_speex module allows an attacker to cause a Denial of Service (DoS) or potentially achieve arbitrary code execution. This issue occurs when Asterisk reads a corrupted Speex audio file, triggering an unbounded memory copy operation. An attacker who can provide a malicious audio file and induce Asterisk to play it can crash the application or compromise the system.
Statement
This vulnerability is rated as Important because an out-of-bounds write during audio parsing can lead to service crashes or potential arbitrary code execution, though exploitation is constrained by the prerequisite of placing a crafted media file on the host. Asterisk is not packaged or supported in Red Hat Enterprise Linux or any other Red Hat product line. Consequently, Red Hat products are not affected by this flaw.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce packet length bounds checks before copying OGG packet data into the 200-byte destination buffer within format_ogg_speex: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11, 22.8-cert3 (or the fixed Asterisk builds), which validates that s->op.bytes is non-negative and does not exceed BUF_SIZE before calling memcpy, logging a warning and returning NULL if out of bounds, closing all 2 injection vectors (crafted Speex audio file playback, oversized OGG packet injection). Until patched, this is only a concern on Asterisk deployments on Linux configured to process and play Speex audio — Red Hat Enterprise Linux and supported Red Hat product lines are unaffected — so Restrict and audit write access to Asterisk media directories to prevent untrusted .spx audio files from being placed and configured for playback. As a compensating measure, Enable ASLR to randomize Asterisk process memory layout and hinder reliable heap targeting, Enforce Full RELRO and PIE to keep GOT entries read-only and randomize code offsets, Implement Control Flow Integrity to restrict indirect call targets and block execution hijacking, Enforce SELinux in enforcing mode to confine the Asterisk process to its defined policy domain, Isolate Asterisk within user, PID, network, and mount namespaces to bound lateral movement, and Drop unnecessary Linux capabilities from the Asterisk process to constrain execution privileges. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap buffer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
