libschroedinger CVE-2026-112053

Exploitation requires the victim application (built against libschroedinger ≤1.0.11) to decode an attacker-supplied, crafted low-delay Dirac stream whose wavelet filter index is 7 or greater, or whose transform depth is 5 or 6 - these exact out-of-range values drive the read past the static quantiser table in schro_params_set_default_quant_matrix. Limiting factors: the CVSS vector is AV:L with UI:P, so an attacker cannot trigger it remotely without a user or service choosing to process the malicious stream; impact is confined to a crash (VA:H, VC:N/VI:N) with no code execution, data disclosure, or integrity loss established by the data.

This is a moderate-severity, availability-only issue that does not rise to an urgent operational priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) describes a local attack requiring passive user interaction, with no confidentiality or integrity impact - the sole consequence is a crash of the decoding application (CWE-125 out-of-bounds read). No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied in the input, so there is no signal of active exploitation or automatable mass-exploitation; by the input's own precision rules this is 'no public exploit identified at time of analysis,' although a third-party technical write-up (hackmd) and a VulnCheck advisory describe the root cause in detail. SSVC-style reasoning: exploitation status appears to be 'none/proof-of-concept,' technical impact is partial (denial of service of the parsing process, not code execution), and it is not obviously automatable since it depends on a victim feeding a crafted Dirac stream to a vulnerable decoder. Note a mild tension in the signals: the vector is AV:L (local) yet the realistic delivery is a malicious media stream/file, which is 'local' in CVSS terms only because the attacker does not touch the network stack directly - verify deployment context, as a service that auto-decodes untrusted Dirac streams would effectively face remote-triggered crashes. Overall this is a 'real but low-priority' DoS bug, not a high-impact RCE despite the OOB-read primitive.

An attacker crafts a malicious low-delay Dirac video stream that sets the wavelet filter index to 7 or higher, or the transform depth to 5 or 6, and delivers it to a victim who opens or processes it with an application linking libschroedinger (≤1.0.11). When schro_params_set_default_quant_matrix reads past the static quantiser table, the decoder performs an out-of-bounds read and the application crashes. No weaponized exploit code is indicated in the input, but a public technical write-up documents the exact trigger conditions.