CVE-2008-1686

no score yetEPSS 6.5%

No CVSS score yet. EPSS 6.5% chance of exploitation in the next 30 days.

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

EPSS: 6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-189
Published: 2008-04-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

xine:xine-lib
xiph:libfishsound
xiph:speex

References

http://blog.kfish.org/2008/04/release-libfishsound-091.html
http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
http://lists.xiph.org/pipermail/speex-dev/2008-April/006636.html
http://secunia.com/advisories/29672
http://secunia.com/advisories/29727

Check your stack JSON