CVE-2026-112053: Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.
Affected Software
Event History
Frequently Asked Questions
What applications are exposed to this issue?
Applications using libschroedinger through 1.0.11 to decode attacker-controlled low-delay Dirac streams are exposed. The described impact is a crash of the decoding application.
What must an attacker provide to trigger the crash?
The attacker must cause the application to process a crafted low-delay Dirac stream. The stream uses a wavelet filter index of 7 or greater, or a transform depth of 5 or 6.
How can I determine whether a crash may be related to this vulnerability?
Check whether the affected application uses libschroedinger through 1.0.11 and was decoding a low-delay Dirac stream when it crashed. Inputs specifying a wavelet filter index of at least 7 or a transform depth of 5 or 6 match the described trigger conditions.