CVE-2026-116741: Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
Vulnerability summary
CVE-2026-116741 is a high (CVSS 8.3) Out-of-bounds Write vulnerability in xiph speex. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 26-10-2026PublishedVulnerability first disclosed.
- 02-11-2026Last modifiedVulnerability information updated.
Description
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.
CVSS metrics
7 scores · 4 sources · 2 versions- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackmd.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- speexAll versions (No fix recorded)
Opensuse1 product
- speex&distro=openSUSE Tumbleweed< 1.2.1-3.1
Ubuntu1 product
- speexAll versions (No fix recorded)
Xiph1 product
- speex≤ 1.2.1
4 vendors · 4 products
References
14 links- github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.cTechnical Description
- www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytesThird Party AdvisoryREPORT
