{"id":"CVE-2026-112054","kind":"vulnerability","aliases":["CVE-2026-112054"],"related":[],"title":"libschroedinger: divide-by-zero in Dirac decoder lets crafted stream crash apps","description":"Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.","summary":"libschroedinger, the Dirac video codec library, divides by zero when a Dirac stream sets slice_bytes_denom or the slice count to zero. An attacker who supplies a crafted low-delay picture can crash any application that decodes it, through a SIGFPE.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dirac-video","libschroedinger","media-decoding","package"],"not_affected_if":["no-dirac-decoding","trusted-input-only"],"how_to_check":"- Check whether the application links libschroedinger, for example with `ldconfig -p | grep schro` or `pkg-config --modversion schroedinger-1.0`\n- Check the installed version against `1.0.11`; unknown whether all releases up to that version are the only affected ones","fix":"- unknown: the sources do not name a patched version or a vendor fix\n- Until a fix is available, reject or do not decode untrusted Dirac streams with libschroedinger","status":"open","published_at":"2026-10-18T13:16:37+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:44:59+00:00","updated_at":"2026-10-25T03:44:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:44:59Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version or a vendor fix\n- Until a fix is available, reject or do not decode untrusted Dirac streams with libschroedinger","reach":"unknown","title":"libschroedinger: divide-by-zero in Dirac decoder lets crafted stream crash apps","impact":"low","summary":"libschroedinger, the Dirac video codec library, divides by zero when a Dirac stream sets slice_bytes_denom or the slice count to zero. An attacker who supplies a crafted low-delay picture can crash any application that decodes it, through a SIGFPE.","category":"package","nicknames":[],"who_cares":["libschroedinger","dirac-video","media-decoding"],"confidence":0.6,"needs_auth":"no","worst_case":"Decoder process crashes with SIGFPE, causing denial of service","analyst_note":"Find a patched version or upstream fix for libschroedinger after 1.0.11 and confirm the source of the NVD entry; the sources give no fix or reach details.","how_to_check":"- Check whether the application links libschroedinger, for example with `ldconfig -p | grep schro` or `pkg-config --modversion schroedinger-1.0`\n- Check the installed version against `1.0.11`; unknown whether all releases up to that version are the only affected ones","needs_analyst":true,"not_affected_if":["no-dirac-decoding","trusted-input-only"],"who_is_affected":"Applications that decode Dirac video streams with libschroedinger through 1.0.11 are exposed when they accept streams from untrusted sources. Systems that never decode Dirac or do not link libschroedinger can skip it. The sources do not say which default configurations or products bundle the library.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3373,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112054':16A,19A '-2026':15A,18A '1.0.11':74C 'allow':82C 'app':13A 'applic':64B,86C 'attack':52B,83C,101C 'byte':43B,92C 'caus':129C 'codec':32B 'contain':75C 'count':48B,96C 'craft':10A,56B,105C 'crash':12A,62B,85C 'cve':14A,17A 'data':123C 'decod':8A,26B,66B,113C,119C 'delay':59B,108C 'denial':130C 'denom':44B,93C 'dirac':7A,21B,30B,39B,99C 'dirac-video':20B 'divid':3A,34B,77C 'divide-by-zero':2A 'let':9A 'librari':33B 'libschroeding':1A,23B,28B,72C 'low':58B,107C 'low-delay':57B,106C 'lowdelay':121C 'media':25B 'media-decod':24B 'packag':27B 'paramet':116C 'pars':110C,114C,120C 'pictur':60B,109C 'provid':103C 'schro':112C,118C 'schroeding':71C 'servic':132C 'set':41B 'sigfp':70B,127C 'slice':42B,47B,91C,95C 'stream':11A,40B,100C 'suppli':54B,88C 'transform':115C,122C 'trigger':125C 'video':22B,31B 'vulner':80C 'zero':5A,36B,50B,79C,90C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode Dirac video streams with libschroedinger through 1.0.11 are exposed when they accept streams from untrusted sources. Systems that never decode Dirac or do not link libschroedinger can skip it. The sources do not say which default configurations or products bundle the library.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112054","severity":null,"published_at":"2026-10-18T13:16:37+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}