Amazon Linux 2023 Security Advisory: ALAS2023-2026-3440
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Medium
Issue Overview:
Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications. (CVE-2026-116741)
Affected Packages:
speex
Issue Correction:
Run dnf update speex --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3440 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
speex-debuginfo-1.2.0-8.amzn2023.0.3.aarch64
speex-devel-1.2.0-8.amzn2023.0.3.aarch64
speex-tools-debuginfo-1.2.0-8.amzn2023.0.3.aarch64
speex-1.2.0-8.amzn2023.0.3.aarch64
speex-debugsource-1.2.0-8.amzn2023.0.3.aarch64
speex-tools-1.2.0-8.amzn2023.0.3.aarch64
src:
speex-1.2.0-8.amzn2023.0.3.src
x86_64:
speex-tools-debuginfo-1.2.0-8.amzn2023.0.3.x86_64
speex-1.2.0-8.amzn2023.0.3.x86_64
speex-tools-1.2.0-8.amzn2023.0.3.x86_64
speex-devel-1.2.0-8.amzn2023.0.3.x86_64
speex-debugsource-1.2.0-8.amzn2023.0.3.x86_64
speex-debuginfo-1.2.0-8.amzn2023.0.3.x86_64