libtta EUVD-2026-103465

Exploitation requires the victim to open or decode an attacker-supplied .tta file whose header declares a channel count of zero within an application that links libtta version 2.3 or earlier; the missing validation in the header check then drives the out-of-bounds cache[-1] access during decorrelation. Limiting factors: the attack vector is local (the malicious file must reach the victim's system) and requires user interaction (UI:P - the victim must process the file), so there is no remote drive-by path and no exposure for systems that never decode untrusted .tta input. Impact is bounded (Low C/I/A), indicating likely crash or constrained stack corruption rather than demonstrated reliable code execution.

This is a moderate, not urgent, priority. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) scores 4.8 (Medium) and is internally consistent with the description: exploitation is local (the attacker must get a crafted .tta file onto the victim's system) and requires passive user interaction (the victim decoding/opening the file). Although PR:N indicates no authentication is needed, the local vector plus required user interaction materially limit real-world risk versus a remote-unauthenticated flaw. Publicly available exploit code exists (POC reported alongside VulnCheck's advisory), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation - treat the POC as a capability signal, not confirmed in-the-wild use. The CWE-787 out-of-bounds write on the stack theoretically enables memory corruption and potential code execution, yet the CVSS impact metrics are only Low across confidentiality, integrity, and availability, suggesting the vendor/analyst assessed limited practical impact (likely crash or constrained corruption rather than reliable RCE). Net: a real but low-to-moderate issue gated by local access and user interaction, worth patching in build pipelines and media-processing tools that embed libtta, but not an emergency.

An attacker crafts a malicious .tta audio file that declares zero channels in its header and distributes it (email attachment, download, media library). When a victim opens or transcodes the file in an application that links libtta ≤2.3, the decoder's decorrelation step reads and writes cache[-1] using stream-derived values, corrupting stack memory. A public proof-of-concept exists, so triggering the out-of-bounds write is straightforward, though reliable code execution beyond a crash is not demonstrated by the available data.