libtta CVE-2026-112011

Exploitation requires a 32-bit build of libtta (through version 2.3) - 64-bit builds are not indicated as affected - and a victim must open or process an attacker-supplied .tta file (UI:P). The crafted file must contain specific unvalidated header fields, concretely a sample rate value of 1 combined with a large samples value, which triggers the integer overflow in tta_decoder_init_get_info() when the seek-table allocation size is computed. Limiting factors: no remote network vector (the attacker only delivers a file, not a live request), reliance on user interaction to open the file, the 32-bit architecture constraint, and the specific malformed header values needed to wrap the allocation - all of which reduce realistic exploitation to targeted delivery of malicious audio files to 32-bit consumers of the library.

This is a moderate-severity, low-urgency issue whose signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H, base 5.8) describes a file-parsing flaw: the attacker does not reach the target over the network but instead supplies a malicious .tta file that a victim must process locally (UI:P), and the dominant impact is availability (VA:H) - an application crash - with only limited integrity impact (VI:L) and no confidentiality impact. AT:P correctly reflects that exploitation depends on conditions outside the attacker's control, namely a 32-bit build and specific header values. Publicly available exploit code exists (per VulnCheck/hackmd advisory), which raises practical POC-driven risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. POC availability and active exploitation are distinct signals and should not be conflated. Net assessment: a genuine, reproducible memory-safety bug worth patching in any product bundling libtta, but it is a client-side denial-of-service on a niche codec rather than a high-priority remote-code-execution emergency. Note: the OOB write (CWE-190 → heap overflow) could in principle be more than a crash, but the description explicitly scopes impact to crashing applications and only on 32-bit builds - 64-bit builds appear unaffected; verify build target with the vendor.

An attacker crafts a malicious .tta audio file whose header declares a sample rate of 1 and an abnormally large samples value, then distributes it (email, download, media library) to a victim running a 32-bit application that uses libtta. When the victim opens the file, the integer overflow in tta_decoder_init_get_info() wraps the seek-table allocation size, producing an undersized buffer and a subsequent heap out-of-bounds write that crashes the application. Public exploit/POC material is available describing the overflow.