Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57197— Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用分支交换机（PBX）和电话通信工具包。在 Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及认证版 Asterisk 20.7-cert11 和 22.8-cert3 之前的版本中，模块在处理 OGG/Speex 数据包时存在无界操作，当读取包含损坏 Speex 音频的文件时，可能导致堆缓冲区溢出并引发 Asterisk 崩溃。攻击者必须能够创建该恶意文件，并通过具备足够特权的途径，或说服 Asterisk 管理员将其部署到系统中，使 Aste

CVSS 7.7 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	< 20.20.1	-
asterisk	certified-asterisk	< 20.7-cert11	-

II. Public POCs for CVE-2026-57197

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57197

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57197 (7)

🔗 GitHub - asterisk/asterisk at 24.0.0-pre1 · GitHub x_refsource_MISC
🔗 Release Asterisk Release 23.4.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 21.12.3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 20.20.1 · asterisk/asterisk · GitHub Read full article x_refsource_MISC
🔗 Release Asterisk Release 22.10.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-22.8-cert3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-20.7-cert11 · asterisk/asterisk · GitHub x_refsource_MISC

Other References for CVE-2026-57197 (8)

https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/1cf189549994e0898954c814ce5a023cd969f1db x_refsource_MISC
https://github.com/asterisk/asterisk/commit/ccec146953b5e13043a36663af84e5a50ca633a6 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/0e6d761ed83f1671632c91805252767eae85e1a2 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/336ebe762bf6dfaf279796700de8ab51f7acd2f3 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/dbcf38933866f0ddd023bc1814a78d4c750b0809 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/29026ece6fdd1834bb8f49c013ef163745ff2bbd x_refsource_MISC
https://github.com/asterisk/asterisk/commit/0a2c1d9e910f7c4dfffa05e328accb8a96990df8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57197

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57202	8.1 HIGH	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57201	7.5 HIGH	Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57188	7.1 HIGH	Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185	6.5 MEDIUM	Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194	5.9 MEDIUM	Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198	2.3 LOW	Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189	2.3 LOW	Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-122