Heap-based buffer overflow in Asterisk Open Source and Certified Asterisk - CVE-2026-57197
Published: June 26, 2026
Vulnerability identifier: #VU135537
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-57197
CWE-ID: CWE-122
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in format_ogg_speex when processing a crafted OGG/Speex audio file. A local user can provide a file containing corrupted speex data to cause a denial of service.
Asterisk must be configured to play the file, and exploitation requires the ability to make the crafted file available to the system or to convince an administrator to do so.
Affected software
Asterisk Open Source
Certified Asterisk
Certified Asterisk
How to mitigate CVE-2026-57197
Install security update from vendor's website.
Asterisk Open Source - addressed in versions 20.20.1, 21.12.3, 22.10.1, 23.4.1
Certified Asterisk - addressed in versions 20.7-cert11, 22.8-cert3
Certified Asterisk - addressed in versions 20.7-cert11, 22.8-cert3