CVE-2026-112012: libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count
libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream() and ttadecoderprocessframe() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Applications that use libtta through version 2.3 to decode attacker-supplied or otherwise untrusted .tta audio files are exposed. Exploitation requires the crafted file to be processed by a local decoding application.
Does an attacker need an account or elevated privileges?
No privileges are required. The CVSS vector indicates local attack access and user interaction are required, meaning a user or local process must open or decode the malicious file.
What is the likely security impact if exploitation succeeds?
The malformed file can cause stack memory corruption during decoding. The reported severity vector rates confidentiality, integrity, and availability impact as low.