CVE-2026-116741

What it actually does

Out-of-bounds write in speex_bits_read_whole_bytes() due to improper length truncation on non-owned SpeexBits buffers initialized with speex_bits_init_buffer() or speex_bits_set_bit_buffer(), enabling heap or stack memory corruption.

Why it matters to the business

Applications that process Speex audio streams can crash or suffer memory corruption, disrupting voice, multimedia, or VoIP services and requiring restarts or incident response.

How an attack unfolds

An attacker prepares a crafted Speex bitstream that triggers length truncation mishandling and streams it into a target application using vulnerable libspeex buffers; the resulting out-of-bounds write corrupts memory and crashes the process.

How to fix it

Upgrade libspeex to the first patched release that corrects the length-truncation logic in bits.c; rebuild and redeploy all dependent applications; validate the fix with targeted regression tests.

How to confirm the fix worked

Confirm the installed libspeex version exceeds 1.2.1, run unit tests covering speex_bits_init_buffer and speex_bits_set_bit_buffer paths, and attempt reproduction with known trigger payloads in a lab environment.

Typical attack path

1. Locate services or applications that link against libspeex 1.2.1 or earlier
2. Generate or obtain Speex data designed to exploit buffer initialization paths
3. Deliver the malicious data via network stream, file, or API input
4. Trigger speex_bits_read_whole_bytes() to perform the out-of-bounds write
5. Observe resulting crash or memory corruption

How to detect it

Review application and system logs for abrupt terminations in processes that call Speex functions; correlate crashes with inbound Speex streams or files processed shortly before the failure.

What your security team should do

• Inventory all software using libspeex and schedule immediate updates
• Add Speex version checks to dependency scanners and CI pipelines
• Monitor application crash logs for Speex-related faults
• Restrict untrusted Speex input sources until patches are applied