An authenticated attacker can trigger a heap buffer overflow by sending specially crafted Codec2 audio packets, leading to potential remote code execution or denial of service. The vulnerability is caused by a floor/ceil sample-count mismatch in the Codec2 decoder, classified as CWE-125, CWE-131, and CWE-787.

The flaw affects Asterisk installations that have the codec_codec2 module loaded and Codec2 configured on an endpoint. Versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7‑cert11, 22.8‑cert3 are vulnerable; the issue is resolved in the listed releases.

With a CVSS score of 6, the vulnerability represents a moderate severity risk. EPSS data is unavailable, but the lack of KEV listing indicates no known widespread exploitation yet. The likely attack scenario requires successful SIP authentication (by username/password or source‑IP matching) and an endpoint capable of Codec2 media. Given the moderate CVSS and the need for valid credentials, the overall exploitability is considered moderate with a potential for significant impact to confidentiality and availability if an attacker bypasses authentication.