AZL-111115: CVE-2026-116741 affecting package speex 1.2.0-6

Q: What application paths are exposed to this issue?

Applications are exposed when they stream crafted Speex data into non-owned SpeexBits buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). The affected operation is speex_bits_read_whole_bytes().

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to be able to supply crafted Speex data to an application that processes that data through the affected non-owned buffer path. The provided information does not indicate that merely having the library installed is sufficient.

Q: What is the expected impact of successful exploitation?

Successful exploitation can corrupt heap or stack memory and crash the application. The provided information does not establish impacts beyond memory corruption and denial of service.

Q: How can I determine whether my application uses the vulnerable path?

Review code that handles streamed Speex input for calls to speex_bits_read_whole_bytes() where the SpeexBits buffer was initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). Versions through Speex 1.2.1 are identified as affected, and the listed package is speex 1.2.0-6.

Published Oct 26, 2026

Updated

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.

Affected Software

1 affected component

azure-linux/speex<=1.2.0-6

Event History

Oct 26, 2026

Advisory Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116741

Frequently Asked Questions

What application paths are exposed to this issue?

Applications are exposed when they stream crafted Speex data into non-owned SpeexBits buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). The affected operation is speex_bits_read_whole_bytes().

What does an attacker need to exploit the vulnerability?

An attacker needs to be able to supply crafted Speex data to an application that processes that data through the affected non-owned buffer path. The provided information does not indicate that merely having the library installed is sufficient.

What is the expected impact of successful exploitation?

Successful exploitation can corrupt heap or stack memory and crash the application. The provided information does not establish impacts beyond memory corruption and denial of service.

How can I determine whether my application uses the vulnerable path?

Review code that handles streamed Speex input for calls to speex_bits_read_whole_bytes() where the SpeexBits buffer was initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). Versions through Speex 1.2.1 are identified as affected, and the listed package is speex 1.2.0-6.

AZL-111115: CVE-2026-116741 affecting package speex 1.2.0-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What application paths are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the expected impact of successful exploitation?

How can I determine whether my application uses the vulnerable path?

Company

Resources

Contact

Frequently Asked Questions

What application paths are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the expected impact of successful exploitation?

How can I determine whether my application uses the vulnerable path?