Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Summary

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

Remediation

1. Inventory every xiph speex deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://gitlab.xiph.org/xiph/speex/-/merge_requests/32
• Advisoryhttps://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write
• Advisoryhttps://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes
• Referencehttps://github.com/xiph/speex/issues/42
• Referencehttps://github.com/xiph/speex
• Referencehttps://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177
• Referencehttps://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write