Speex through version 1.2.1-2.oe2203sp4 contains an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw mishandles length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt heap or stack memory and cause application crashes. A fix is available in version 1.2.1-2.oe2203sp4.