Out-of-Bounds Write Vulnerability in Speex by Xiph Foundation
CVE-2026-116741

8.3HIGH

Key Information:

Vendor

Xiph

Status
Speex
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116741?

Speex (libspeex) versions up to and including 1.2.1 are susceptible to an out-of-bounds write vulnerability found in the speex_bits_read_whole_bytes() function. This flaw arises from improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to send maliciously crafted Speex data to corrupt heap or stack memory. Such exploitation could result in application crashes, leading to denial of service and potential data corruption.

Affected Version(s)

speex 0 <= 1.2.1

References

https://github.com/xiph/speex/issues/42
issue-tracking
https://github.com/xiph/speex
product
https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/b...
technical-description

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.