Live › vulnerability › CVE-2026-112007
Go to dashboardSchism Tracker, a music tracker app, fails to bounds-check the sample count when loading .ult module files. A crafted .ult file overwrites the instruments pointer array, so the app frees attacker-chosen pointers and crashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who opens a .ult module in an affected Schism Tracker build can be hit, since the bad data is in the file itself. Users who never load untrusted .ult files are at low risk. unknown whether the sources describe any other entry path.
No product ranges from the sources yet.
schismtracker -v or check the installed version against the date 20260524, since the sources say versions through 20260524 are affected20260524Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-112007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.