Speex
Monthly
An out-of-bounds write in libspeex's speex_bits_read_whole_bytes() (libspeex/bits.c) affects Speex through 1.2.1 and triggers only when an application decodes into a caller-provided, non-owned SpeexBits buffer created with speex_bits_init_buffer() or speex_bits_set_bit_buffer(); crafted Speex data then overflows that buffer because length truncation is mishandled, corrupting heap or stack memory and crashing the process. Remote, unauthenticated attackers can reach it wherever such streams are processed, but exposure is conditional on the vulnerable buffer APIs being in use - reflected as AT:P in the CVSS 4.0 vector and as moderate real-world priority in the provided assessment, with EPSS at 0.41% (35th percentile), no CISA KEV listing, and a public PoC reference (a HackMD writeup) that is not verified as working exploit code. The overall rating is denial-of-service-weighted (A:H, I:L, no confidentiality impact), and a fix has been proposed upstream.
An out-of-bounds write in libspeex's speex_bits_read_whole_bytes() (libspeex/bits.c) affects Speex through 1.2.1 and triggers only when an application decodes into a caller-provided, non-owned SpeexBits buffer created with speex_bits_init_buffer() or speex_bits_set_bit_buffer(); crafted Speex data then overflows that buffer because length truncation is mishandled, corrupting heap or stack memory and crashing the process. Remote, unauthenticated attackers can reach it wherever such streams are processed, but exposure is conditional on the vulnerable buffer APIs being in use - reflected as AT:P in the CVSS 4.0 vector and as moderate real-world priority in the provided assessment, with EPSS at 0.41% (35th percentile), no CISA KEV listing, and a public PoC reference (a HackMD writeup) that is not verified as working exploit code. The overall rating is denial-of-service-weighted (A:H, I:L, no confidentiality impact), and a fix has been proposed upstream.