Out-of-Bounds Read Vulnerability in Schroedinger Library by Distrotech
CVE-2026-112053

6.8MEDIUM

Key Information:

Vendor

Schroedinger

Status
Schroedinger
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112053?

The libschroedinger library up to version 1.0.11 is vulnerable to an out-of-bounds read, which may allow attackers to read past a static quantiser table. This vulnerability arises when an attacker supplies unvalidated values for the wavelet filter index (7 or higher) or transform depth (5 or 6). By leveraging this flaw, they can craft a low-delay Dirac stream that, when processed by decoding applications, can lead to application crashes and potential unauthorized information access.

Affected Version(s)

schroedinger 0 <= 1.0.11

References

https://hackmd.io/@haindpwn/schroedinger-lowdelay-quant-m...
third-party-advisory
https://github.com/Distrotech/schroedinger/blob/schroedin...
technical-description
https://www.vulncheck.com/advisories/schroedinger-libschr...
third-party-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.