{"id":"CVE-2026-116741","aliases":["AZL-111115","DEBIAN-CVE-2026-116741","EUVD-2026-110489","GHSA-jmfj-jxhf-c4c3","OESA-2026-4747","OESA-2026-4748","OESA-2026-4749","OESA-2026-4750","UBUNTU-CVE-2026-116741","openSUSE-SU-2026:12336-1"],"status":"published","title":"Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00418,"percentile":0.36591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-26T21:52:40Z","modified":"2026-11-11T12:45:06Z","fixes":[{"ecosystem":"openEuler:24.03-LTS-SP4","package":"speex","fixed_in":["1.2.1-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"speex","fixed_in":["1.2.1-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"speex","fixed_in":["1.2.1-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"speex","fixed_in":["1.2.1-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"speex","fixed_in":["1.2.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2","1.2.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu1","1.2~rc1.2-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu1","1.2~rc1.2-1ubuntu2","1.2~rc1.2-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu2","1.2~rc1.2-1.1ubuntu1","1.2~rc1.2-1.1ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1.1ubuntu1","1.2~rc1.2-1.1ubuntu2","1.2~rc1.2-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2ubuntu1","1.2.1-2ubuntu2","1.2.1-2ubuntu2.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3","1.2.1-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"speex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-3.1"}]}]}],"products":[{"vendor":"xiph","product":"speex"}],"references":[{"url":"https://github.com/xiph/speex/issues/42","tags":["issue-tracking","report"]},{"url":"https://github.com/xiph/speex","tags":["product","package","report"]},{"url":"https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177","tags":["technical-description","article"]},{"url":"https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write","tags":["third-party-advisory","advisory","report"]},{"url":"https://gitlab.xiph.org/xiph/speex/-/merge_requests/32","tags":["patch","fix","report"]},{"url":"https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes","tags":["third-party-advisory","advisory","report"]},{"url":"https://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116741","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jmfj-jxhf-c4c3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116741.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116741","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4747","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4748","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4749","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4750","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116741","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/116xxx/cve-2026-116741.json","tags":["report"]},{"url":"https://github.com/xiph/speex/blob/speex-1.2.1/libspeex/bits.c#l177","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-116741","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116741","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-116741","title":"Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T21:52:40.782Z","modified":"2026-11-02T18:32:03.764Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T19:47:06.831391Z"}],"euvd":[{"id":"EUVD-2026-110489","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T21:52:40Z","modified":"2026-11-02T18:32:03Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T05:08:38.713005Z"}],"ghsa":[{"id":"GHSA-jmfj-jxhf-c4c3","title":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in...","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-27T00:32:48Z","modified":"2026-11-02T21:31:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-116741","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T22:16:58.53Z","modified":"2026-11-02T19:17:57.837Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-03T00:02:36.126212Z"}],"osv":[{"id":"CVE-2026-116741","title":"Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T21:52:40.782Z","modified":"2026-11-04T02:30:40.06815739Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"DEBIAN-CVE-2026-116741","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T22:16:58.53Z","modified":"2026-11-03T10:00:31.551206162Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"OESA-2026-4747","title":"speex security update","description":"Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs.\r\n\r\nSecurity Fix(es):\n\nSpeex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)","status":"published","published":"2026-11-11T12:25:46Z","modified":"2026-11-11T12:45:06.216017104Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4748","title":"speex security update","description":"Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs.\r\n\r\nSecurity Fix(es):\n\nSpeex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)","status":"published","published":"2026-11-11T12:25:47Z","modified":"2026-11-11T12:45:05.293377821Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4749","title":"speex security update","description":"Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs.\r\n\r\nSecurity Fix(es):\n\nSpeex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)","status":"published","published":"2026-11-11T12:25:47Z","modified":"2026-11-11T12:45:05.490038005Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4750","title":"speex security update","description":"Speex is an Open Source/Free Software patent-free audio compression format designed for speech. The Speex Project aims to lower the barrier of entry for voice applications by providing a free alternative to expensive proprietary speech codecs. Moreover, Speex is well-adapted to Internet applications and provides useful features that are not present in most other codecs.\r\n\r\nSecurity Fix(es):\n\nSpeex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.(CVE-2026-116741)","status":"published","published":"2026-11-11T12:25:48Z","modified":"2026-11-11T12:45:05.482916102Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-116741","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T22:16:00Z","modified":"2026-10-28T20:17:45.887574347Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"AZL-111115","title":"CVE-2026-116741 affecting package speex 1.2.0-6","description":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","status":"published","published":"2026-10-26T22:16:58Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"openSUSE-SU-2026:12336-1","title":"libspeex1-1.2.1-3.1 on GA media","description":"These are all security issues fixed in the libspeex1-1.2.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:06.948807953Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}