DEBIAN-CVE-2026-57197: Buffer Overflow

Q: Which Asterisk deployments are exposed?

Exposure requires a vulnerable Asterisk or Certified Asterisk release and configuration that plays the malicious OGG/Speex file. Systems that do not make such a file available to Asterisk or do not play it do not meet the described trigger conditions.

Q: What does an attacker need to exploit this issue?

The attacker must create a corrupted Speex audio file and make it available to Asterisk, either through sufficiently elevated privileges or by convincing an Asterisk administrator to provide the file. No user interaction is required once Asterisk is configured to play that file.

Q: How can I determine whether the issue is fixed?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3. Compare the deployed version with the applicable fixed release and review whether OGG/Speex files from untrusted sources can be made available for playback.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded memcpy of OGG/Speex packet data in formatoggspeex can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Asterisk deployments are exposed?

Exposure requires a vulnerable Asterisk or Certified Asterisk release and configuration that plays the malicious OGG/Speex file. Systems that do not make such a file available to Asterisk or do not play it do not meet the described trigger conditions.

What does an attacker need to exploit this issue?

The attacker must create a corrupted Speex audio file and make it available to Asterisk, either through sufficiently elevated privileges or by convincing an Asterisk administrator to provide the file. No user interaction is required once Asterisk is configured to play that file.

How can I determine whether the issue is fixed?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3. Compare the deployed version with the applicable fixed release and review whether OGG/Speex files from untrusted sources can be made available for playback.

DEBIAN-CVE-2026-57197: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Asterisk deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether the issue is fixed?

Company

Resources

Contact

Frequently Asked Questions

Which Asterisk deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether the issue is fixed?