<html><body><div dir="auto">Source: speex<br>Version: 1.2.1-3<br>Severity: important<br>Tags: security upstream fixed-upstream patch<br><br>Hi,<br><br>The following vulnerability was published for speex. The security tracker<br>currently records no fix, but upstream merged one on 2026-11-01:<br><br>CVE-2026-116741[0]:<br>Speex (libspeex) through 1.2.1 contains an out-of-bounds write in<br>speex_bits_read_whole_bytes() in libspeex/bits.c. When the SpeexBits<br>structure does not own its buffer and the input is larger than the free<br>space, nchars is truncated to bits->buf_size, ignoring the bytes already<br>in the buffer (bits->nbBits). The copy loop then writes up to<br>pos + buf_size bytes, i.e. past the end of the caller-supplied buffer.<br><br>Upstream report:  <a href="https://www.google.com/url?q=https://github.com/xiph/speex/issues/42&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=https://github.com/xiph/speex/issues/42&source=gmail&ust=1793764410596000&sa=E</a><br>Upstream fix:     <a href="https://www.google.com/url?q=https://gitlab.xiph.org/xiph/speex/-/merge_requests/32&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=https://gitlab.xiph.org/xiph/speex/-/merge_requests/32&source=gmail&ust=1793764410596000&sa=E</a><br>                  <a href="https://www.google.com/url?q=https://gitlab.xiph.org/xiph/speex/-/commit/09b569d1b437e5edccf3406a38714ad795e46d38&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=https://gitlab.xiph.org/xiph/speex/-/commit/09b569d1b437e5edccf3406a38714ad795e46d38&source=gmail&ust=1793764410596000&sa=E</a><br><br>The fix is a one-line change that uses the same bound as the existing<br>realloc-failure branch:<br><br>--- a/libspeex/bits.c<br>+++ b/libspeex/bits.c<br>@@ -174,7 +174,7 @@ EXPORT void speex_bits_read_whole_bytes(SpeexBits *bits, const char *chars, int<br>          }<br>       } else {<br>          speex_warning("Do not own input buffer: truncating oversize input");<br>-         nchars=bits->buf_size;<br>+         nchars=bits->buf_size-(bits->nbBits>>LOG2_BITS_PER_CHAR)-1;<br>       }<br>    }<br><br>I checked that it applies cleanly to the 1.2.1-3 source (patch -p1<br>--dry-run against libspeex/bits.c from <a href="https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793764410596000&sa=E</a>). I have not<br>built or runtime-tested the package with it.<br><br>If you fix the bug, please make sure to include the CVE identifier in<br>your changelog entry.<br><br>[0] <a href="https://www.google.com/url?q=https://security-tracker.debian.org/tracker/CVE-2026-116741&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=https://security-tracker.debian.org/tracker/CVE-2026-116741&source=gmail&ust=1793764410596000&sa=E</a><br>    <a href="https://www.google.com/url?q=https://www.cve.org/CVERecord?id%3DCVE-2026-116741&source=gmail&ust=1793764410596000&sa=E">https://www.google.com/url?q=https://www.cve.org/CVERecord?id%3DCVE-2026-116741&source=gmail&ust=1793764410596000&sa=E</a><br><br>Thanks!<br></div></body></html>