OESA-2026-4750: speex security update
Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs. Security Fix(es):
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer() or speexbitssetbitbuffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/speexto a version that resolves this vulnerability.Fixed in 1.2.1-3.oe2403sp3
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libspeex through 1.2.1 are exposed when they process attacker-controlled Speex data using non-owned SpeexBits buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer().
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to stream crafted Speex data to a vulnerable application. No authentication or user interaction is required according to the supplied severity vector.
What is the likely impact of successful exploitation?
Crafted input can cause an out-of-bounds write that corrupts heap or stack memory and crashes the application. The provided severity information indicates high availability impact and low integrity impact.
How can I determine whether my application is affected?
Check whether it uses libspeex version 1.2.1 or earlier and whether its code paths process untrusted Speex input through buffers configured with speex_bits_init_buffer() or speex_bits_set_bit_buffer().