{"id":"CVE-2026-112007","kind":"vulnerability","aliases":["CVE-2026-112007"],"related":[],"title":"Schism Tracker: crafted ULT module overwrites heap, crashes the application","description":"Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.","summary":"Schism Tracker, a music tracker app, fails to bounds-check the sample count when loading .ult module files. A crafted .ult file overwrites the instruments pointer array, so the app frees attacker-chosen pointers and crashes.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","music-software","other","schism-tracker"],"not_affected_if":["no-untrusted-ult-files"],"how_to_check":"- Run `schismtracker -v` or check the installed version against the date `20260524`, since the sources say versions through 20260524 are affected\n- unknown whether the sources give a version-specific check beyond that","fix":"- unknown: the sources do not name a fixed version or patch; check the Schism Tracker project for a release newer than `20260524`","status":"open","published_at":"2026-10-18T12:17:13+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:41:02+00:00","updated_at":"2026-10-25T03:41:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:41:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or patch; check the Schism Tracker project for a release newer than `20260524`","reach":"local","title":"Schism Tracker: crafted ULT module overwrites heap, crashes the application","impact":"medium","summary":"Schism Tracker, a music tracker app, fails to bounds-check the sample count when loading .ult module files. A crafted .ult file overwrites the instruments pointer array, so the app frees attacker-chosen pointers and crashes.","category":"other","nicknames":[],"who_cares":["schism-tracker","music-software","desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"Application crashes; attacker-chosen pointers are freed, possibly enabling worse memory corruption","analyst_note":"","how_to_check":"- Run `schismtracker -v` or check the installed version against the date `20260524`, since the sources say versions through 20260524 are affected\n- unknown whether the sources give a version-specific check beyond that","needs_analyst":false,"not_affected_if":["no-untrusted-ult-files"],"who_is_affected":"Anyone who opens a .ult module in an affected Schism Tracker build can be hit, since the bad data is in the file itself. Users who never load untrusted .ult files are at low risk. unknown whether the sources describe any other entry path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000588,"input_tokens":3360,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112007':13A,16A '-2026':12A,15A '20260524':66C 'app':30B,55B 'applic':10A,121C 'array':52B,108C 'attack':58B,96C,115C 'attacker-chosen':57B,114C 'bound':34B,73C 'bounds-check':33B 'byte':90C 'caus':109C 'check':35B 'chosen':59B,116C 'clamp':86C 'contain':67C 'count':38B,92C 'craft':3A,45B,100C 'crash':8A,62B,119C 'csf':110C 'cve':11A,14A 'desktop':17B 'destroy':111C 'fail':31B,84C 'file':43B,47B 'fmt':77C 'fmt/ult.c':82C 'free':56B,113C 'heap':7A,69C 'instrument':50B,106C 'load':40B,79C 'max':94C 'modul':5A,42B,102C 'music':19B,28B 'music-softwar':18B 'one':89C 'one-byt':88C 'out-of-bound':70C 'overwrit':6A,48B,104C 'pointer':51B,60B,107C,117C 'sampl':37B,91C,95C 'schism':1A,23B,25B,63C 'schism-track':22B 'softwar':20B 'song':80C 'suppli':98C 'tracker':2A,24B,26B,29B,64C 'ult':4A,41B,46B,78C,101C 'vulner':75C 'write':74C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens a .ult module in an affected Schism Tracker build can be hit, since the bad data is in the file itself. Users who never load untrusted .ult files are at low risk. unknown whether the sources describe any other entry path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112007","severity":null,"published_at":"2026-10-18T12:17:13+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}