Live › vulnerability › CVE-2026-116741
Go to dashboardSpeex (libspeex) through 1.2.1 has an out-of-bounds write in speex_bits_read_whole_bytes() when the bit buffer is set with speex_bits_init_buffer() or speex_bits_set_bit_buffer(). Streaming crafted Speex data can corrupt heap or stack memory and crash the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that decode Speex audio from untrusted sources, such as VoIP, voice chat or media servers, and that use the non-owned buffer API (speex_bits_init_buffer or speex_bits_set_bit_buffer) are exposed. Programs that only decode local files they control, or that use the default owned-buffer path, are less exposed. unknown whether the default path is safe.
No product ranges from the sources yet.
pkg-config --modversion speex or ldd <binary> | grep speexspeex_bits_init_buffer or speex_bits_set_bit_bufferspeex through 1.2.1 is affected, fixed version unknown1.2.1 once a fixed version is published (unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-116741")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.