Stack Out-of-Bounds Read and Write Vulnerability in libtta by gchudov
CVE-2026-112012
4.8MEDIUM
What is CVE-2026-112012?
libtta, a library for processing TTA (True Tap Audio) files, contains a vulnerability that allows for stack out-of-bounds read and write due to improper header checks. When a crafted .tta file with a zero channel count is processed through the tta_decoder_process_stream() and tta_decoder_process_frame() functions, the absence of validation leads to unexpected memory access, potentially allowing attackers to corrupt stack memory. This could result in unpredictable behavior in applications using libtta, making it essential for users to implement mitigation strategies.
Affected Version(s)
libtta 0 <= 2.3
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology