CVE-2026-112007: Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong() in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy() to free attacker-chosen pointers and crash the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Schism Tracker through 20260524 are exposed when they open or load an attacker-supplied .ult module. The attack vector is local and requires user interaction.
What does an attacker need to exploit it?
An attacker needs to provide a crafted .ult module with a sample count that exceeds MAX_SAMPLES. No privileges are required, but the target must cause Schism Tracker to process the file.
What is the likely impact of successful exploitation?
The crafted module can overwrite the instruments pointer array. When csf_destroy() later frees attacker-chosen pointers, the application can crash; the reported integrity impact is low and availability impact is high.