EUVD-2026-111110Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain file-placement privileges or social-engineer admin
-
DeliveryStage crafted corrupted OGG/Speex file
-
ExploitAsterisk configured to play the file
-
ExecutionPlayback triggers unbounded memcpy in format_ogg_speex
-
ImpactHeap buffer overflow crashes Asterisk
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following: (1) the attacker can create a file containing corrupted Speex audio and make it available to Asterisk, either using their own sufficiently elevated privileges or by convincing an Asterisk administrator to deploy the file; and (2) Asterisk must be explicitly configured to play that specific file. These are concrete, non-default prerequisites: the attack is not remote-unauthenticated against a default install. Limiting factors are the need for privilege or administrator cooperation to place the file (PR:L) and the requirement that the malicious file be in Asterisk's playback configuration, which together narrow realistic exploitation to insiders or successful social engineering. Confirmed impact from the evidence is a crash of the Asterisk process (denial of service). |
| Impact | This is a moderate-priority issue rather than an emergency, consistent with the vuln.today 'this_week' decision label. Signals are mixed: the input CVSS 4.0 vector (7.7) asserts AV:N with full VC:H/VI:H/VA:H impact, but the vendor description and GHSA advisory describe only a crash and require the attacker to create a corrupted OGG/Speex file, place it where Asterisk can reach it (using their own sufficiently elevated privileges or by convincing an administrator), AND have Asterisk explicitly configured to play it - a chain far closer to local/privileged, config-dependent exploitation (AT:P and PR:L already reflect this) than to remote-unauthenticated attack. The AV:N labeling conflicts with the file-placement mechanism in the description; treat the realistic vector as local/config-dependent and verify with the vendor. The VC:H/VI:H impact is also not substantiated: CWE-122/787 heap overflow writes can in principle lead to code execution, but the available evidence states only that Asterisk crashes, so confidentiality/integrity compromise is unverified. No EPSS score was provided, the CVE is not in CISA KEV, and no public PoC or exploit reference appears in the inputs (only the vendor advisory, fix commits, and release tags). Net: a legitimate availability/DoS bug worth patching within the week, but the preconditions (privilege or social engineering plus playback configuration) meaningfully limit real-world exploitability and argue against treating it as a widespread remote threat. |
| Exploit ScenarioDerived | An attacker able to place files where Asterisk reads media - either through existing sufficiently elevated privileges or by convincing an Asterisk administrator to deploy the file - supplies a file containing corrupted Speex audio and ensures Asterisk is configured to play it. When Asterisk reads the file, an unbounded memcpy of the OGG/Speex packet data overflows a fixed-size heap buffer and crashes the service, causing a denial of service. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A malformed OGG/Speex audio file can trigger a heap buffer overflow in Asterisk's format_ogg_speex module, crashing the telephony process and causing denial of service. Affected versions are Asterisk 20.x before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1, and Certified Asterisk before 20.7-cert11 and 22.8-cert3. Exploitation requires a low-privileged or administrator-assisted file placement and Asterisk must be configured to play the crafted file; confirmed impact is a crash, and no public exploit was identified at time of analysis.
RemediationAI
Vendor-released patch: Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified Asterisk 20.7-cert11, and 22.8-cert3 contain the packet-length bounds check and should be applied. Release references are available at https://github.com/asterisk/asterisk/releases/tag/20.20.1, https://github.com/asterisk/asterisk/releases/tag/21.12.3, https://github.com/asterisk/asterisk/releases/tag/22.10.1, https://github.com/asterisk/asterisk/releases/tag/23.4.1, https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11, and https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3, with the advisory at https://github.com/asterisk/asterisk/security/advisories/GHSA-8jhw-m2hg-vp3h. Until upgraded, exposure is limited by the stated preconditions: restrict who can place files in Asterisk playback/media directories and avoid configuring Asterisk to play OGG/Speex files of unverified origin, since the issue only triggers when such a file is played. No other vendor-documented workaround is provided.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Asterisk's OGG/Speex file format handler in formats/format_ogg_speex.c reads Speex audio packets out of OGG pages into a fixed-size buffer. The flaw is an unbounded memcpy of the packet payload: the OGG packet length (s->op.bytes) was not checked against the destination buffer size (BUF_SIZE), so a corrupted or crafted Speex stream can write past the heap allocation. This is CWE-122 (heap-based buffer overflow), also tracked as CWE-787 (out-of-bounds write). The upstream fix adds a guard that rejects packets whose length is negative or greater than BUF_SIZE, logs a warning, and skips the packet. The vulnerable path is reached when Asterisk plays an OGG/Speex file, such as a prompt or music-on-hold source, and the trigger is a malformed packet length in that file.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be placed via local privileges or admin action and Asterisk configured to play it, so AV:L/PR:L; evidence confirms only a crash, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded memcpy of OGG/Speex packet data in format_ogg_speex can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
CWE-122 (heap-based buffer overflow; the advisory also tags CWE-787).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Asterisk telephony systems are vulnerable to a heap buffer overflow via malformed OGG/Speex audio files, causing service crashes and denial of service. The flaw affects multiple supported release branches and requires low-privileged file placement plus playback configuration, potentially disrupting call handling and business communications. Leadership should prioritize patching to prevent operational outages and maintain service availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB