{"id":"UBUNTU-CVE-2026-116741","details":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","modified":"2026-10-28T20:17:45.887574347Z","published":"2026-10-26T22:16:00Z","upstream":["CVE-2026-116741"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-116741"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-116741"},{"type":"REPORT","url":"https://github.com/xiph/speex"},{"type":"REPORT","url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/116xxx/cve-2026-116741.json"},{"type":"REPORT","url":"https://github.com/xiph/speex/blob/speex-1.2.1/libspeex/bits.c#l177"},{"type":"REPORT","url":"https://github.com/xiph/speex/issues/42"},{"type":"REPORT","url":"https://gitlab.xiph.org/xiph/speex/-/merge_requests/32"},{"type":"REPORT","url":"https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/cve-2026-116741"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes"}],"affected":[{"package":{"name":"speex","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=esm-infra%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu1","1.2~rc1.2-1ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2~rc1.2-1ubuntu1+esm1"},{"binary_name":"libspeexdsp1","binary_version":"1.2~rc1.2-1ubuntu1+esm1"},{"binary_name":"speex","binary_version":"1.2~rc1.2-1ubuntu1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu1","1.2~rc1.2-1ubuntu2","1.2~rc1.2-1ubuntu2.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2~rc1.2-1ubuntu2.1","binary_name":"libspeex1"},{"binary_name":"libspeexdsp1","binary_version":"1.2~rc1.2-1ubuntu2.1"},{"binary_name":"speex","binary_version":"1.2~rc1.2-1ubuntu2.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1ubuntu2","1.2~rc1.2-1.1ubuntu1","1.2~rc1.2-1.1ubuntu1.20.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2~rc1.2-1.1ubuntu1.20.04.1"},{"binary_name":"libspeexdsp1","binary_version":"1.2~rc1.2-1.1ubuntu1.20.04.1"},{"binary_version":"1.2~rc1.2-1.1ubuntu1.20.04.1","binary_name":"speex"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2~rc1.2-1.1ubuntu1","1.2~rc1.2-1.1ubuntu2","1.2~rc1.2-1.1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2~rc1.2-1.1ubuntu3"},{"binary_name":"libspeexdsp1","binary_version":"1.2~rc1.2-1.1ubuntu3"},{"binary_name":"speex","binary_version":"1.2~rc1.2-1.1ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2ubuntu1","1.2.1-2ubuntu2","1.2.1-2ubuntu2.24.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2.1-2ubuntu2.24.04.1"},{"binary_name":"speex","binary_version":"1.2.1-2ubuntu2.24.04.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/speex?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2.1-3build1"},{"binary_name":"speex","binary_version":"1.2.1-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}},{"package":{"name":"speex","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/speex?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-3","1.2.1-3build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libspeex1","binary_version":"1.2.1-3build1"},{"binary_name":"speex","binary_version":"1.2.1-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116741.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}