Skip to content
OpenAdvisories
Medium ALAS2023-2026-3440 1 CVE

Moderate: speex security update (Amazon Linux 2023)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-116741: Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 speex 0:1.2.0-8.amzn2023.0.3
Amazon Linux · 2023 speex-debuginfo 0:1.2.0-8.amzn2023.0.3
Amazon Linux · 2023 speex-debugsource 0:1.2.0-8.amzn2023.0.3
Amazon Linux · 2023 speex-devel 0:1.2.0-8.amzn2023.0.3
Amazon Linux · 2023 speex-tools 0:1.2.0-8.amzn2023.0.3
Amazon Linux · 2023 speex-tools-debuginfo 0:1.2.0-8.amzn2023.0.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-116741

    Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

    Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up wit…

    xiph speex speex speex Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-116741.html