CVE-2008-1686: Xine Xine-Lib

High severity, CVSS 9.3. EPSS: 6.5% chance of exploitation in the next 30 days.

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Affected products

• Xine Xine-Lib: up to and including 1.1.11.1; version 0.9.8 only; version 0.9.13 only; version 0.99 only; version 1.0 only; version 1.0.1 only; …
• Xiph Libfishsound: up to and including 0.9.0; version 0.5.41 only; version 0.5.42 only; version 0.6.0 only; version 0.6.1 only; version 0.6.2 only; …
• Xiph Speex: up to and including 1.1.12; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.5 only; version 1.1.1 only; …

Published 2008-04-08. Last modified 2026-06-16.