{"id":"CVE-2026-112011","kind":"vulnerability","aliases":["CVE-2026-112011"],"related":[],"title":"libtta: crafted TTA file overflows heap on 32-bit builds","description":"libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.","summary":"libtta is a library for decoding TTA audio files, and through version 2.3 its decoder computes a seek table allocation from unchecked header fields that can wrap around. An attacker who supplies a crafted .tta file can cause a heap buffer overflow that crashes the application and may allow more.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","audio","c","package"],"not_affected_if":["64-bit-only-build","no-untrusted-tta-input"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T12:17:13+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:10:20+00:00","updated_at":"2026-10-25T04:10:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"libtta: crafted TTA file overflows heap on 32-bit builds","impact":"medium","summary":"libtta is a library for decoding TTA audio files, and through version 2.3 its decoder computes a seek table allocation from unchecked header fields that can wrap around. An attacker who supplies a crafted .tta file can cause a heap buffer overflow that crashes the application and may allow more.","category":"package","nicknames":[],"who_cares":["c","audio","32-bit"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted file crashes the application; heap overflow may enable more.","analyst_note":"Check the NVD entry and the libtta repository for a patched version and whether the 64-bit build is affected.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-tta-input","64-bit-only-build"],"who_is_affected":"Applications that decode untrusted .tta files with libtta 2.3 or earlier, built for 32-bit targets, are exposed. Systems that never parse TTA audio from outside sources, or that run 64-bit builds only, are less likely to be affected; the sources do not confirm the 64-bit case.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000569,"input_tokens":3344,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112011':13A,16A '-2026':12A,15A '1':114C '2.3':34B,73C '32':8A,17B,95C 'alloc':41B,123C 'allow':70B,86C 'applic':67B,126C 'around':49B 'attack':51B,87C,102C 'audio':19B,29B 'bit':9A,18B,96C 'buffer':62B,92C 'build':10A,97C 'c':20B 'caus':59B,89C 'comput':37B 'contain':74C 'craft':2A,55B,106C 'crash':65B,125C 'cve':11A,14A 'decod':27B,36B,81C 'field':45B,101C 'file':4A,30B,57B,108C 'get':83C 'header':44B,100C 'heap':6A,61B,91C 'info':84C 'init':82C 'integ':76C 'larg':116C 'librari':25B 'libtta':1A,22B,71C 'may':69B 'overflow':5A,63B,77C,93C 'packag':21B 'rate':112C 'sampl':111C,117C 'seek':39B,121C 'suppli':53B,104C 'tabl':40B,122C 'tta':3A,28B,56B,80C,107C 'uncheck':43B 'unvalid':99C 'valu':118C 'version':33B 'via':98C 'vulner':78C 'wrap':48B,119C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted .tta files with libtta 2.3 or earlier, built for 32-bit targets, are exposed. Systems that never parse TTA audio from outside sources, or that run 64-bit builds only, are less likely to be affected; the sources do not confirm the 64-bit case.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112011","severity":null,"published_at":"2026-10-18T12:17:13+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}