CVE-2026-116741

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex bits read whole bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex bits init buffer() or speex bits set bit buffer() to corrupt heap or stack memory and crash applications.