PT-2026-125490

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speex bits read whole bytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex bits init buffer or speex bits set...