Speex through version 1.2.1 contains an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw mishandles length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted data that can corrupt heap or stack memory and cause application crashes. The issue is fixed in version 1.2.1-3.oe2403sp1. The vulnerability has a high severity score of 8.3 CVSS 4.0.