Skip to main content
VulnerabilityPublished Updated

Espeak ng: Global-buffer-overflow

Affects espeak-ngSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in f0fb11a8e1308d56a981e640db09678a2c43848c

Data as of 8 Nov 2026, 14:50 UTC

What to do

Upgrade espeak-ng to f0fb11a8e1308d56a981e640db09678a2c43848c.

Affected software

ProductAffectedFixed in
OSS-Fuzzespeak-ngAffected
  • >=0a713d52bbf3e061823d1a7f35e5303e7320f27a <f0fb11a8e1308d56a981e640db09678a2c43848c
  • =1.51
  • =1.52.0
Fixed in
  • f0fb11a8e1308d56a981e640db09678a2c43848c

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been applied in commit f0fb11a8e1308d56a981e640db09678a2c43848c. Users should update to the fixed version to remediate this vulnerability.

Description

A global buffer overflow vulnerability exists in the GetSsmlAttribute function of espeak-ng versions 1.51 and 1.52.0. This issue was reported by OSS-Fuzz and involves an out-of-bounds read leading to a crash. The vulnerability has been fixed in a later commit.

References

Community reviews

Loading reviews…