EUVD-2026-110489

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116741

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116741

The Speex (libspeex) library, versions through 1.2.1 , is vulnerable to an out-of-bounds write in the speex_bits_read_whole_bytes() function located in libspeex/bits.c. The root cause is the incorrect handling of length truncation for non-owned SpeexBits buffers . An attacker can exploit this by ...

CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

PT-2026-125490

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speex bits read whole bytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex bits init buffer or speex bits set...

Debian GNU/Linux Data Compromise

The multiple vulnerabilities in the libspeex-dev package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...