# CVE-2026-57192: Asterisk heap buffer overflow in Codec2 decoder

Source: https://junglewise.ai/threats/cve-2026-57192-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57192 · Severity: info · Published 2026-10-27

Asterisk is an open-source phone system and telecommunications toolkit used to manage voice, video, and messaging communications. An authenticated attacker who can establish a call using Codec2 audio compression can trigger a heap buffer overflow by sending specially crafted audio packets, potentially causing a crash or code execution. This requires the Codec2 module to be loaded and the attacker to pass SIP authentication.

Technologies: [Asterisk Project Asterisk](https://junglewise.ai/threats/technologies/asterisk-project-asterisk), [Asterisk Project Certified Asterisk](https://junglewise.ai/threats/technologies/asterisk-project-certified-asterisk). Vendors: [Asterisk Project](https://junglewise.ai/threats/vendors/asterisk-project).

## Quick answers

**Is CVE-2026-57192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57192 being exploited in the wild.

**How severe is CVE-2026-57192?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Asterisk Project Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1; Asterisk Project Certified Asterisk prior to 20.7-cert11, 22.8-cert3.

**Is there a fix for CVE-2026-57192?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Until then: Disable the codec_codec2 module if Codec2 is not required, or restrict SIP access to trusted IP addresses to limit authentication bypass vectors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57192 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57192?** Check whether you run Asterisk Project Asterisk or Asterisk Project Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

Disable the codec_codec2 module if Codec2 is not required, or restrict SIP access to trusted IP addresses to limit authentication bypass vectors.

## Technical details

A floor/ceiling mismatch in the Codec2 decoder causes an out-of-bounds write: the codec2_samples() function uses floor division to compute output buffer space, but the decode loop uses a condition that allows one extra iteration with ceiling behavior when the input length is not a multiple of CODEC2_FRAME_LEN. The fix changes the loop condition from (x < datalen) to (x + CODEC2_FRAME_LEN <= datalen) to process only complete frames. Attack requires SIP authentication (username/password or source IP) and an established call.

## Affected products

- Asterisk Project Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1
- Asterisk Project Certified Asterisk prior to 20.7-cert11, 22.8-cert3

## Timeline

- 2026-10-27: disclosed: CVE-2026-57192 published
- 2026: patched: Fix released in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3

## References

- [https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079](https://github.com/asterisk/asterisk/commit/02e2d8d51efe1f811f2929224339cb1a35ffc079)
- [https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56](https://github.com/asterisk/asterisk/commit/4f5cad0611c67638a0a61cfedbe645045da8dd56)

## Related threats

- [Asterisk SMS buffer overflow in app_sms](https://junglewise.ai/threats/cve-2026-57199-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk buffer overflow in MWI NOTIFY parser](https://junglewise.ai/threats/cve-2026-57191-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk SQL injection in CEL event logging](https://junglewise.ai/threats/cve-2026-57190-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk buffer over-read in PJSIP MWI parser](https://junglewise.ai/threats/cve-2026-57185-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk heap-use-after-free in PJSIP TCP/SDP handling](https://junglewise.ai/threats/cve-2026-57187-asterisk-is-an-open-source-private-branch-exchange-and-telephony)