diff --git a/media/libopus/celt/bands.c b/media/libopus/celt/bands.c
--- a/media/libopus/celt/bands.c
+++ b/media/libopus/celt/bands.c
@@ -262,17 +262,19 @@
          {
             g = 16384*32768;
             shift = -2;
          }
          do {
-            *f++ = SHL32(MULT16_32_Q15(*x++, g), -shift);
+            *f++ = SHL32(MULT16_32_Q15(*x, g), -shift);
+            x++;
          } while (++j<band_end);
       } else
 #endif
          /* Be careful of the fixed-point "else" just above when changing this code */
          do {
-            *f++ = SHR32(MULT16_32_Q15(*x++, g), shift);
+            *f++ = SHR32(MULT16_32_Q15(*x, g), shift);
+            x++;
          } while (++j<band_end);
    }
    celt_assert(start <= end);
    OPUS_CLEAR(&freq[bound], N-bound);
 }
diff --git a/media/libopus/moz.build b/media/libopus/moz.build
--- a/media/libopus/moz.build
+++ b/media/libopus/moz.build
@@ -19,11 +19,11 @@
 
 FINAL_LIBRARY = "gkcodecs"
 NoVisibilityFlags()
 
 DEFINES["OPUS_BUILD"] = True
-DEFINES["OPUS_VERSION"] = "5a29ca93acc1b165498e1d8938d7bdfdf89c167a"
+DEFINES["OPUS_VERSION"] = "b5aad6a28299bd92939588f23d3ba3dafd5804f2"
 DEFINES["USE_ALLOCA"] = True
 DEFINES["ENABLE_HARDENING"] = True
 
 # Don"t export symbols
 DEFINES["OPUS_EXPORT"] = ""
diff --git a/media/libopus/moz.yaml b/media/libopus/moz.yaml
--- a/media/libopus/moz.yaml
+++ b/media/libopus/moz.yaml
@@ -18,15 +18,15 @@
   # Usually different from repository url
   url: https://opus-codec.org/
 
   # Human-readable identifier for this version/release
   # Generally "version NNN", "tag SSS", "bookmark SSS"
-  release: 5a29ca93acc1b165498e1d8938d7bdfdf89c167a (2025-03-14T17:51:14.000-04:00).
+  release: b5aad6a28299bd92939588f23d3ba3dafd5804f2 (2025-03-18T14:01:52.000-04:00).
 
   # Revision to pull in
   # Must be a long or short commit SHA (long preferred)
-  revision: 5a29ca93acc1b165498e1d8938d7bdfdf89c167a
+  revision: b5aad6a28299bd92939588f23d3ba3dafd5804f2
 
   # The package's license, where possible using the mnemonic from
   # https://spdx.org/licenses/
   # Multiple licenses can be specified (as a YAML list)
   # A "LICENSE" file must exist containing the full license text
diff --git a/media/libopus/silk/decode_core.c b/media/libopus/silk/decode_core.c
--- a/media/libopus/silk/decode_core.c
+++ b/media/libopus/silk/decode_core.c
@@ -56,11 +56,17 @@
     silk_assert( psDec->prev_gain_Q16 != 0 );
 
     ALLOC( sLTP, psDec->ltp_mem_length, opus_int16 );
     ALLOC( sLTP_Q15, psDec->ltp_mem_length + psDec->frame_length, opus_int32 );
     ALLOC( res_Q14, psDec->subfr_length, opus_int32 );
+    /* Work around a clang bug (verified with clang 6.0 through clang 20.1.0) that causes the last
+       memset to be flagged as an invalid read by valgrind (not caught by asan). */
+#if defined(__clang__) && defined(VAR_ARRAYS)
+    ALLOC( sLPC_Q14, MAX_SUB_FRAME_LENGTH + MAX_LPC_ORDER, opus_int32 );
+#else
     ALLOC( sLPC_Q14, psDec->subfr_length + MAX_LPC_ORDER, opus_int32 );
+#endif
 
     offset_Q10 = silk_Quantization_Offsets_Q10[ psDec->indices.signalType >> 1 ][ psDec->indices.quantOffsetType ];
 
     if( psDec->indices.NLSFInterpCoef_Q2 < 1 << 2 ) {
         NLSF_interpolation_flag = 1;