CVE-2016-2232

CVE-2016-2232 describes a denial-of-service vulnerability affecting Asterisk Open Source versions 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1, as well as Certified Asterisk versions 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3. This flaw allows remote authenticated users to trigger an uninitialized pointer dereference and crash the system by sending a zero-length error correcting redundancy packet for a lost UDPTL FAX packet. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited over the network with low attack complexity by a low-privileged user, resulting in high availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.