Speex through version 1.2.1 contains an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw mishandles length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted data to corrupt heap or stack memory and potentially crash applications. A fix is available in version 1.2.1-3.oe2403sp4.