CVE-2026-112011: libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table
libtta through 2.3 contains an integer overflow vulnerability in ttadecoderinitgetinfo() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The described heap buffer overflow affects applications using libtta through 2.3 on 32-bit builds. The issue is triggered while processing attacker-supplied .tta audio files.
What does an attacker need to do to trigger the flaw?
An attacker must convince a user or application to open a crafted .tta file. The file uses unvalidated header fields, including a sample rate of 1 and a large samples value, to wrap the seek-table allocation.
What is the expected impact?
The wrapped seek-table allocation can lead to a heap buffer overflow and crash the application. The provided severity vector indicates local attack conditions, high attack complexity, required user interaction, no confidentiality impact, low integrity impact, and high availability impact.