Speex (libspeex) through version 1.2.1 contains an out‑of‑bounds write in the function speex_bits_read_whole_bytes(). When the library incorrectly truncates the length for non‑owned SpeexBits buffers, an attacker can write past the end of a buffer. This corrupts heap or stack memory and can cause application crashes or, if an attacker controls the overwritten memory, remote code execution. Based on the description, it is inferred that remote code execution is possible if the attacker can control the overwritten memory. The problem is a classic instance of the CWE‑787 class where a library performs an insecure write beyond the boundary of allocated memory.

The vulnerability affects the Speex codec library from Xiph.Org, specifically all releases up to and including 1.2.1. Applications that incorporate libspeex and use speex_bits_init_buffer() or speex_bits_set_bit_buffer() for non‑owned buffers are at risk.

The vulnerability has a CVSS score of 8.3, indicating high severity. No EPSS score is available, so the likelihood of exploitation is currently unknown. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need the ability to supply crafted Speex data to a vulnerable process, which can be done over a network stream or other input channel. The flaw can be triggered by an attacker who can influence the input stream, potentially leading to memory corruption and application crashes or privilege escalation if the attacker can control overwritten memory. Existing systems that stream Speex audio directly to libspeex without additional validation remain in scope.