Schism Tracker CVE-2026-112007

Exploitation requires the victim to open an attacker-supplied, specially crafted .ult (UltraTracker) module file in Schism Tracker version through 20260524; the malicious file sets a one-byte sample count that is not clamped to MAX_SAMPLES, triggering the heap out-of-bounds write. Limiting factors: the attack vector is local file parsing (not network-reachable), mandatory user interaction (the victim must load the file) is required, and no authentication or special non-default configuration is needed since any build parsing .ult files is affected. The confirmed outcome is an application crash via freeing attacker-chosen pointers; reliable code execution would additionally depend on heap-layout control.

This is a moderate-severity, client-side memory-corruption flaw whose real-world risk is low despite the availability of public exploit code. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) correctly characterizes it as a local, user-interaction-dependent issue: an attacker cannot reach the vulnerable fmt_ult_load_song() parser remotely but must convince a victim to open a crafted .ult module file. Publicly available exploit code exists (hackmd write-up plus VulnCheck advisory), raising the practical likelihood of weaponization, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - this appears to be no public exploit of in-the-wild activity, only proof-of-concept. The primary demonstrated impact is availability loss (crash via csf_destroy() freeing attacker-chosen pointers), with the heap out-of-bounds write and arbitrary-free primitive raising a plausible but unproven path to code execution; the input vector itself scores VI:L rather than full integrity compromise. Net assessment: a genuine bug worth patching in affected deployments, but not an urgent fleet-wide priority given the niche product, local-only vector, and required user interaction.

An attacker crafts a malicious .ult tracker module with a one-byte sample count exceeding MAX_SAMPLES and distributes it via a music-sharing site, forum, or email attachment. When a victim opens the file in Schism Tracker, the loader writes past the instruments pointer array on the heap, and on cleanup csf_destroy() frees attacker-controlled pointers, crashing the application. Public proof-of-concept exploit code for this out-of-bounds write is already available.