CVE-2026-116741

EUVD-2026-110489
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.94%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
xiphspeex
𝑥
≤ 1.2.1
CNA
Common Weakness Enumeration
References
https://github.com/xiph/speex
https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177
https://github.com/xiph/speex/issues/42
https://gitlab.xiph.org/xiph/speex/-/merge_requests/32
https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write
https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes