CVE-2026-116741
Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
xiph speex
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
Text from CVE List
Affected versions 1
- speexaffected: all versions through 1.2.1CVE List
References 6
- gitlab.xiph.org/xiph/speex/-/merge_requests/32Fixvia CVE List
- hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-writeAdvisoryvia CVE List
- vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytesAdvisoryvia CVE List
- github.com/xiph/speex/issues/42Referencevia CVE List
- github.com/xiph/speexReferencevia CVE List
- github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177Referencevia CVE List