Speex libspeex: Out-of-bounds write in speex_bits_read_whole_bytes()

Summary

Speex (libspeex) through 1.2.1 contains an out-of-bounds write in speex_bits_read_whole_bytes() that mishandles length truncation for buffers not owned by the library. An attacker who can stream crafted Speex data into an application using speex_bits_init_buffer() or speex_bits_set_bit_buffer() can corrupt heap or stack memory. The most reliable effect is a crash of the affected application; code execution is speculated but not confirmed.

Affected

• Speex (libspeex) up to and including 1.2.1
• Applications that embed libspeex and pass untrusted data through speex_bits_init_buffer() or speex_bits_set_bit_buffer()
• Distribution packages: status unclear, Red Hat lists fix deferred for RHEL 10, Ubuntu lists needs evaluation

Fixed in

Unknown.

• A candidate fix exists as GitLab merge request 32, but its merge and release status could not be confirmed.
• No confirmed fixed release or vendor advisory was found.

Workaround

• Restrict which applications process untrusted Speex streams or files.
• Validate the length of incoming Speex data and check buffer bounds before passing it to the library, if you control the application code.
• Keep the affected code out of internet-facing services where possible.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• A third-party write-up exists; its content was not reviewed and public proof of concept is not confirmed.

Our recommendation

• Inventory systems and applications that bundle libspeex or the speex package and record their versions.
• Ask software vendors whether their products use the affected buffer APIs with untrusted input.
• Apply vendor patches as soon as they are available and track the Xiph GitLab merge request and your distribution security trackers.
• Restrict exposure of affected applications until a fix is confirmed.
• Monitor for crashes of applications that process Speex audio.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Xiph Speex GitHub mirror github.com
• bits.c at Speex-1.2.1 github.com
• Speex issue #42 github.com
• Xiph GitLab merge request 32 gitlab.xiph.org
• VulnCheck advisory www.vulncheck.com
• HackMD write-up hackmd.io
• Ubuntu security notice ubuntu.com
• OpenCVE entry app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:13.