CVE-2026-112013
Received Received - Intake

libtta Divide-by-Zero Vulnerability in Audio Decoder

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112013
EUVD
EUVD-2026-103466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
True Audio libtta 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libtta through version 2.3 has a divide-by-zero flaw in the tta_decoder_init_get_info() function. Attackers can crash applications by providing a .tta file with a zero sample rate that isn't properly validated. The file's header CRC32 can be manipulated to trigger a SIGFPE signal, causing the application to crash.

Detection Guidance

To detect this vulnerability, inspect .tta files for a zero sample rate in the header. Use tools like hexdump or a hex editor to check the sample rate field in the file header. If the sample rate is zero, the file may trigger the divide-by-zero vulnerability.

Impact Analysis

This vulnerability allows attackers to crash applications that use libtta, including the bundled tta console tool. If exploited, it could lead to denial-of-service conditions, disrupting services that rely on libtta for True Audio file processing.

Compliance Impact

This vulnerability causes application crashes via SIGFPE due to divide-by-zero, which could disrupt data processing workflows. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could interrupt critical healthcare data handling. However, the provided context does not specify direct compliance impacts or data breach implications.

Mitigation Strategies

Update libtta to the latest version beyond 2.3. If updating is not possible, avoid processing untrusted .tta files. Implement input validation to reject files with a zero sample rate in the header.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart