Read the docs
TI-2026-80950 Aliases CVE-2026-116741GHSA-jmfj-jxhf-c4c3

Out-of-bounds write in Speex libspeex bit buffer handling

Priority HIGH 69CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Speex (libspeex) through 1.2.1 contains an out-of-bounds write (CWE-787) in speex_bits_read_whole_bytes(), which mishandles length truncation for buffers the library does not own. A remote, unauthenticated attacker can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xiphspeexup to 1.2.1—No fix listedCNA
  • speex Vendorxiph Affected up to 1.2.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Speex. Red Hat lists no fix available for Red Hat Enterprise Linux 7, 8, 9 and 10, and no fix planned for Red Hat Enterprise Linux 6.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116741
  2. 2026-10-27 Affected versions changed · Red Hat
  3. 2026-10-27 CVSS score added · Red Hat
  4. 2026-10-27 Alias added: GHSA-jmfj-jxhf-c4c3
  5. 2026-10-27 Priority changed: MEDIUM → LOW
  6. 2026-11-02 CISA SSVC decision points changed
  7. 2026-11-02 Priority changed: LOW → HIGH

References

Patch 1

Advisory 1

Other 3

  • TI-2022-23282 A null pointer dereference issue was discovered in functions op_get_data and op_open1 in… CVSS 3.1HIGH 7.8
  • TI-2018-13329 A buffer overflow was discovered in the URL-authentication backend of the Icecast before… CVSS 3.0HIGH 8.1
  • TI-2024-37350 oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an… CVSS 3.1CRITICAL 9.8
  • TI-2008-01616 Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and… CVSS 2.0HIGH 9.3
  • TI-2007-01289 Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote… CVSS 2.0HIGH 9.3
  • TI-2023-23216 Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute… CVSS 3.1HIGH 7.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences