OESA-2026-4749: speex security update
Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs. Security Fix(es):
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/speexto a version that resolves this vulnerability.Fixed in 1.2.1-3.oe2403sp1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libspeex through 1.2.1 may be exposed if they process attacker-controlled Speex data using buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). The issue can corrupt heap or stack memory and crash the application.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied CVSS vector. An attacker needs to be able to stream crafted Speex data to a vulnerable application.
What configuration condition is required for exploitation?
The vulnerable path involves non-owned SpeexBits buffers. The application must set up the relevant buffer with speex_bits_init_buffer() or speex_bits_set_bit_buffer() and process crafted input through the affected code.