CVE-2026-112011
Received Received - Intake

Integer Overflow Leading to Heap Buffer Overflow in libtta

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112011
EUVD
EUVD-2026-103464

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
True Audio libtta 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in libtta through version 2.3 that occurs in the tta_decoder_init_get_info() function. Attackers can exploit unvalidated header fields in a crafted .tta file by setting a sample rate of 1 and a large samples value. This causes the seek table allocation to wrap around on 32-bit builds, leading to a heap buffer overflow when the application crashes.

Detection Guidance

To detect this vulnerability, inspect systems using libtta versions 2.3 or earlier. Check for crashes when processing .tta files with unusual header fields like sample rate 1 and large samples value. Use static analysis tools to review code for integer overflows in tta_decoder_init_get_info().

Commands: 1) Check libtta version: grep -r "libtta" /usr/local/lib or package manager. 2) Test with crafted .tta files: use a hex editor to create files with sample rate 1 and large samples. 3) Monitor crashes in applications using libtta.

Impact Analysis

This vulnerability can crash applications using libtta, potentially allowing attackers to execute arbitrary code or cause denial-of-service conditions. It specifically affects systems running 32-bit builds of libtta when processing malicious .tta files.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling heap buffer overflows through crafted .tta files, potentially leading to unauthorized data access, corruption, or denial of service. Such memory corruption issues may violate integrity and availability requirements under these regulations.

Mitigation Strategies

Immediately update libtta to the latest version if available. If not, disable or remove libtta from systems. Block .tta file processing in applications until patched. Monitor for crashes or unusual memory usage in audio processing software.

For systems unable to update, restrict access to .tta files and implement strict input validation for audio files. Consider using alternative libraries like FFmpeg's TTA decoder which includes proper guards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart