EUVD-2026-111396Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPass SIP authentication to endpoint
-
DeliveryNegotiate and establish Codec2 call
-
ExploitSend crafted Codec2 audio packets
-
ExecutionTrigger floor/ceil out-of-bounds heap write
-
ImpactCrash Asterisk process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a specific, non-default stack: the codec_codec2 module must be loaded AND the Codec2 codec must be configured on the attacked endpoint. The attacker must first pass SIP authentication - either via valid username/password or by having a source IP that matches an allowed/trusted address - then establish a call negotiated to Codec2, and finally send carefully crafted Codec2 audio packets that trigger the floor/ceil sample-count mismatch. Limiting factors: authentication is mandatory (PR:L), Codec2 is an uncommon codec that must be explicitly enabled (so most default deployments are not affected), and the confirmed impact is a crash/denial of service rather than data exposure or code execution. |
| Impact | This is a medium-severity, availability-only issue, not a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H, base 6.0) tells a consistent story with the description: network-reachable but authenticated (PR:L), with an attack requirement (AT:P) corresponding to the non-default precondition that the codec_codec2 module is loaded and Codec2 is configured on the attacked endpoint. Impact is confined to availability (VA:H) - a heap buffer overflow/out-of-bounds write that realistically crashes the process (DoS); the vector explicitly sets VC:N/VI:N, so there is no confirmed confidentiality or integrity impact despite the 'Information Disclosure' tag and the NVD CWE-125 label (the GHSA advisory lists CWE-125, CWE-131 and CWE-787, and an out-of-bounds write is the operative weakness). No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied - only the fix commits and advisory. The vuln.today decision label is 'this_month', aligning with the signals: real but gated by authentication and a non-default codec configuration, so it warrants scheduled patching rather than emergency response. Memory-safety write primitives can sometimes be escalated beyond DoS, but the available evidence characterizes impact as availability only; do not assume code execution. |
| Exploit ScenarioDerived | An attacker who can pass SIP authentication (by username/password or source-IP matching) against an Asterisk endpoint that has codec_codec2 loaded and Codec2 configured establishes a call negotiated to use Codec2, then streams specially crafted Codec2 audio packets. A floor/ceil sample-count mismatch in the codec2tolin_framein decoder loop causes an out-of-bounds heap write, corrupting memory and crashing the Asterisk process (denial of service). No public exploit was provided in the available data; only the vendor fix commits and advisory are available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A heap buffer overflow in the Codec2 transcoding module (codec_codec2) of Asterisk can be triggered by an authenticated SIP caller who negotiates the Codec2 codec and then sends a crafted audio frame, resulting in an out-of-bounds write that crashes the channel/process and denies service. Affected are Asterisk 20.x before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1, plus Certified Asterisk before 20.7-cert11 and before 22.8-cert3; exploitation requires the codec_codec2 module to be loaded and Codec2 explicitly configured on the targeted endpoint, which is not a default configuration. The assessed impact is availability-only (crash/denial of service) against a medium-severity baseline; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data.
RemediationAI
Vendor-released patches exist: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 / 22.8-cert3, using the tagged releases at https://github.com/asterisk/asterisk/releases/tag/20.20.1, .../21.12.3, .../22.10.1, .../23.4.1, .../certified-20.7-cert11 and .../certified-22.8-cert3; the underlying fixes are the commits referenced in the advisory (including 02e2d8d51efe1f811f2929224339cb1a35ffc079, which corrects the frame-length loop guard in codecs/codec_codec2.c). Where an immediate upgrade is not possible, the effective compensating control is to remove the exposure path itself: unload or blacklist the codec_codec2 module (noload in modules.conf) and remove Codec2 from all endpoint codec allow-lists so calls cannot negotiate it - the trade-off is that any endpoints or trunks that legitimately depend on Codec2 lose the ability to place or receive those calls, and the module cannot be removed if other configured endpoints still require it. Because the attacker must first pass SIP authentication by username/password or by source-IP matching, tightening SIP authentication (strong credentials, avoiding broad IP-based trust) reduces the population of possible triggers but is not a complete fix, since an authenticated user with Codec2 permission remains a viable attacker. Pending patch verification, monitoring Asterisk logs for abnormal channel termination or process crashes during Codec2-negotiated calls can provide early warning of attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Codec2 is a low-bitrate speech codec (roughly 700-3200 bps) used in narrowband and radio-oriented voice applications; Asterisk exposes it through the loadable codec_codec2.so transcoding module, which converts between Codec2 frames and Asterisk's internal linear PCM. The vulnerable code in codecs/codec_codec2.c walked the payload of an incoming frame in CODEC2_FRAME_LEN byte increments using the condition x < f->datalen, so a trailing partial chunk containing fewer bytes than a complete Codec2 frame was still handed to the decoder. Because the decoder's sample-count computation rounds between floor and ceil for partial/irregular frame lengths, the mismatch produced a write one element past the end of the allocated sample buffer. The upstream fix changes the loop guard to x + CODEC2_FRAME_LEN <= f->datalen, so only complete frames are decoded and truncated tails are ignored. The advisory classifies the defect under CWE-125 (out-of-bounds read), CWE-131 (incorrect calculation of buffer size) and CWE-787 (out-of-bounds write), with the CVE record citing CWE-125; the observable consequence assessed here is memory corruption confined to availability. The CPE entries confirm both the mainline asterisk package and the commercially supported certified-asterisk package are in scope, meaning LTS/Certified deployments need the corresponding certified releases rather than the mainline builds.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Authenticated so PR:L; AC:H reflects the non-default requirement that Codec2 be loaded and configured; impact is a crash, so A:H with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch. The codec_codec2 module must be loaded and Codec2 must be configured on the attacked endpoint. The attacker must pass SIP authentication by username/password or source IP address matching, establish a call using Codec2, and send carefully crafted Codec2 audio packets. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB