Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck
CVE-2026-116741Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
Medium 6.5
In plain English
A medium-severity out-of-bounds write in speex from xiph. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | speex | no fix listed | DEBIAN-CVE-2026-116741 |
| Debian:13 | speex | no fix listed | DEBIAN-CVE-2026-116741 |
| Debian:14 | speex | no fix listed | DEBIAN-CVE-2026-116741 |
| Ubuntu:22.04:LTS | speex | no fix listed | UBUNTU-CVE-2026-116741 |
| Ubuntu:24.04:LTS | speex | no fix listed | UBUNTU-CVE-2026-116741 |
| Ubuntu:26.04:LTS | speex | no fix listed | UBUNTU-CVE-2026-116741 |
| Ubuntu:26.10 | speex | no fix listed | UBUNTU-CVE-2026-116741 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- GitHub Issue #42 issue-tracking
- https://github.com/xiph/speex product
- https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177 technical-description
- https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write third-party-advisory
- https://gitlab.xiph.org/xiph/speex/-/merge_requests/32 patch
- VulnCheck Advisory: Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes third-party-advisory
- https://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write exploit