{"id":"CVE-2026-112012","kind":"vulnerability","aliases":["CVE-2026-112012"],"related":[],"title":"libtta: crafted TTA file with zero channels corrupts stack memory","description":"libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.","summary":"libtta, a library for decoding True Audio (TTA) files, does not reject a header declaring zero channels. A crafted .tta file therefore makes the decoder read and write outside a stack buffer, corrupting memory in any application that decodes it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["audio-decoding","c","libtta","package"],"not_affected_if":["no-tta-decoding"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T12:17:13+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:26:44+00:00","updated_at":"2026-10-25T04:26:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"libtta: crafted TTA file with zero channels corrupts stack memory","impact":"medium","summary":"libtta, a library for decoding True Audio (TTA) files, does not reject a header declaring zero channels. A crafted .tta file therefore makes the decoder read and write outside a stack buffer, corrupting memory in any application that decodes it.","category":"package","nicknames":[],"who_cares":["libtta","c","audio-decoding"],"confidence":0.6,"needs_auth":"no","worst_case":"Stack memory corrupted in decoding process, possible code execution","analyst_note":"Check the NVD entry and the upstream libtta repository for a fixed version and whether a crafted file can lead to code execution.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-tta-decoding"],"who_is_affected":"Applications that link libtta and decode .tta files supplied by users or other untrusted sources are exposed. Systems that never decode TTA input, or only decode files they created, have less reason to worry. The sources do not list fixed versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000546,"input_tokens":3353,"output_tokens":422,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':109C '-112012':13A,16A '-2026':12A,15A '2.3':64C 'access':107C 'applic':59B,120C 'attack':95C 'audio':18B,29B 'audio-decod':17B 'bound':71C 'buffer':54B 'c':20B 'cach':108C 'channel':7A,39B,93C,104C 'check':88C 'contain':65C 'corrupt':8A,55B,115C 'count':94C 'craft':2A,41B,99C 'cve':11A,14A 'declar':37B,102C 'decod':19B,27B,47B,61B,78C,83C,119C 'decorrel':106C 'deriv':113C 'file':4A,31B,43B,101C 'frame':85C 'header':36B,87C 'librari':25B 'libtta':1A,21B,23B,62C 'make':45B 'memori':10A,56B,117C 'never':89C 'out-of-bound':68C 'outsid':51B 'packag':22B 'process':79C,84C 'read':48B,72C 'reject':34B,90C 'stack':9A,53B,67C,116C 'stream':80C,112C 'stream-deriv':111C 'suppli':97C 'therefor':44B 'true':28B 'tta':3A,30B,42B,77C,82C,100C 'valu':114C 'vulner':75C 'write':50B,74C 'zero':6A,38B,92C,103C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libtta and decode .tta files supplied by users or other untrusted sources are exposed. Systems that never decode TTA input, or only decode files they created, have less reason to worry. The sources do not list fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112012","severity":null,"published_at":"2026-10-18T12:17:13+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}