---
id: "CVE-2026-112013"
kind: "vulnerability"
aliases: ["CVE-2026-112013"]
title: "libtta: crafted TTA file with zero sample rate crashes decoder"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["audio-decoding", "c", "libtta", "package"]
not_affected_if: ["libtta-not-used", "no-untrusted-tta-input"]
published_at: "2026-10-18T12:17:14+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:45:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112013", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# libtta: crafted TTA file with zero sample rate crashes decoder

libtta is a C library for decoding True Audio (TTA) files; through version 2.3, tta_decoder_init_get_info() divides by a sample rate read from the file without checking it is non-zero. An attacker who supplies a .tta file with a zero sample rate and a recomputed header CRC32 makes the application crash with SIGFPE.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project uses libtta by searching dependencies and sources for `libtta` or `tta_decoder_init_get_info`
- Check the installed version with `unknown` if the sources do not give a command; the affected range is through `2.3`

## Fix

- unknown: the sources do not name a fixed version or patch; check the upstream libtta repository for a release after `2.3`
- Until patched, reject .tta files whose header sample rate is zero before passing them to the decoder

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112013

## From the sources

libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_