OESA-2026-4748: speex security update
Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs. Security Fix(es):
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/speexto a version that resolves this vulnerability.Fixed in 1.2.1-2.oe2203sp4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libspeex through version 1.2.1 are exposed if they process attacker-controlled Speex data through non-owned SpeexBits buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer().
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to stream crafted Speex data to a vulnerable application. No privileges or user interaction are required according to the provided severity vector.
What is the likely impact of successful exploitation?
The out-of-bounds write can corrupt heap or stack memory and crash the affected application. The severity vector indicates high availability impact and low integrity impact.
How can I determine whether an application may be affected?
Review whether it uses libspeex version 1.2.1 or earlier and whether it accepts untrusted Speex input using buffers configured with speex_bits_init_buffer() or speex_bits_set_bit_buffer().