OESA-2026-4747: speex security update

Q: Which applications are most likely to be exposed?

Applications using libspeex through version 1.2.1 that stream Speex data into non-owned SpeexBits buffers are the relevant exposure group. The vulnerable buffer setups are those created with speex_bits_init_buffer() or speex_bits_set_bit_buffer().

Q: What does an attacker need to exploit this issue?

An attacker needs to supply crafted Speex data that is streamed into an affected non-owned buffer. The reported vector is network-accessible and does not require privileges or user interaction.

Q: What is the expected impact on an affected application?

Crafted input can cause an out-of-bounds write, corrupting heap or stack memory and crashing the application. The supplied severity data indicates high availability impact and low integrity impact, with no confidentiality impact reported.

Published Nov 11, 2026

Updated

Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs. Security Fix(es):

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)

Affected Software

1 affected componentFixes available

openeuler/speex<1.2.1-3.oe2403sp4

1.2.1-3.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/speex to a version that resolves this vulnerability.
Fixed in 1.2.1-3.oe2403sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116741

Frequently Asked Questions

Which applications are most likely to be exposed?

Applications using libspeex through version 1.2.1 that stream Speex data into non-owned SpeexBits buffers are the relevant exposure group. The vulnerable buffer setups are those created with speex_bits_init_buffer() or speex_bits_set_bit_buffer().

What does an attacker need to exploit this issue?

An attacker needs to supply crafted Speex data that is streamed into an affected non-owned buffer. The reported vector is network-accessible and does not require privileges or user interaction.

What is the expected impact on an affected application?

Crafted input can cause an out-of-bounds write, corrupting heap or stack memory and crashing the application. The supplied severity data indicates high availability impact and low integrity impact, with no confidentiality impact reported.

OESA-2026-4747: speex security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are most likely to be exposed?

What does an attacker need to exploit this issue?

What is the expected impact on an affected application?

Company

Resources

Contact

Frequently Asked Questions

Which applications are most likely to be exposed?

What does an attacker need to exploit this issue?

What is the expected impact on an affected application?