CVE-2026-116741: Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Speex through 1.2.1 are exposed when they process attacker-controlled Speex data through a non-owned SpeexBits buffer initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). The vulnerable operation is speex_bits_read_whole_bytes() in libspeex/bits.c.
What does an attacker need to exploit it?
An attacker needs to be able to stream crafted Speex data to the application. No privileges or user interaction are required, but exploitation has high attack complexity.
Are applications using ordinary internally managed SpeexBits buffers affected?
The described flaw specifically concerns non-owned SpeexBits buffers. Exposure depends on whether the application sets up buffers with speex_bits_init_buffer() or speex_bits_set_bit_buffer() and then reads crafted data through the affected function.
What is the likely impact of successful exploitation?
The out-of-bounds write can corrupt heap or stack memory and crash the application. The supplied severity vector indicates availability impact is high and integrity impact is low, with no confidentiality impact.