libtta CVE-2026-112013

Exploitation requires an attacker to deliver a specially crafted .tta file in which the sample-rate field is set to zero AND the header CRC32 is recomputed so the malformed file passes integrity validation; the victim (or a victim application such as the bundled tta console tool or any program linking libtta ≤2.3) must then open or decode that file via tta_decoder_init_get_info(). Limiting factors: the vector is local and requires victim interaction (UI:P) to process the file, there is no remote-unauthenticated path, and the impact is confined to a single-process crash - no privilege gain, code execution, or data disclosure. Risk is further bounded to deployments that actually embed libtta for TTA decoding.

This is a moderate-severity, availability-only denial-of-service flaw whose real-world priority is low-to-moderate. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and tells a consistent story: there is no confidentiality or integrity impact, exploitation is local and depends on a victim passively processing attacker-supplied input (UI:P), and the only consequence is a crash (VA:H via SIGFPE). Public exploit code exists (reported by VulnCheck), which raises operational relevance, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - a POC for a crash bug is not the same as in-the-wild abuse. The attack requires crafting a .tta file with a recomputed header CRC32 so the malformed zero sample rate survives validation, which is trivial technical work but still demands that the file reach and be opened by a target. Net: a legitimate bug worth patching in any product that embeds libtta, but not an emergency - the ceiling is a single-process crash, not code execution or data loss. One cross-source caveat: the sole 'exploit' reference is titled 'libtta-seek-table-count-overflow-oob-write,' which describes an out-of-bounds WRITE via seek-table count overflow - a different weakness class than this CWE-369 divide-by-zero; defenders should verify they are tracking the correct issue and not conflate the two.

An attacker crafts a malicious .tta audio file that declares a sample rate of zero and recomputes the header CRC32 so the file passes integrity checks. When a victim opens or processes this file with an application that links libtta (such as the bundled tta console tool or a media player), tta_decoder_init_get_info() performs a division using the zero sample rate, triggering SIGFPE and crashing the process. A publicly available proof-of-concept for the crash exists.