libschroedinger EUVD-2026-103516

Exploitation requires that the victim application link libschroedinger (Schroedinger) at version 1.0.11 or earlier AND decode an attacker-supplied Dirac stream containing a crafted low-delay picture whose slice_bytes_denom or slice count field is zero, hitting the division in schro_decoder_parse_transform_parameters / schro_decoder_parse_lowdelay_transform_data. Limiting factors that reduce realistic risk: the vector is LOCAL (the malicious stream/file must be delivered to and processed by the victim), passive user interaction is required (UI:P - the victim must open/decode the media), and the impact is confined to availability (an application crash via SIGFPE) with no code execution, data disclosure, or integrity loss. Only deployments that actually use the Schroedinger Dirac decoder path are affected.

This is a denial-of-service-only vulnerability whose real-world priority is modest despite the medium CVSS 4.0 score of 6.8. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: the attack vector is LOCAL (a crafted Dirac stream/file must reach the parser), it requires passive user interaction (UI:P - the victim must open or decode the media), and the only impact is availability (VA:H), with no confidentiality or integrity loss (VC:N/VI:N). This aligns well with the description and CWE-369 (divide by zero causing SIGFPE), so the signals are internally consistent rather than conflicting. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no public exploit identified at time of analysis; however, a third-party technical write-up (hackmd) and a VulnCheck advisory exist that detail the exact vulnerable code paths (schro_decoder_parse_transform_parameters / schro_decoder_parse_lowdelay_transform_data), which lowers the bar for a researcher to reproduce it. Net assessment: this is a genuine but low-urgency crash bug - not a high-CVSS-but-fictional risk, yet also not a priority for most defenders because it yields only a crash, requires local delivery plus user interaction, and affects a niche, effectively retired codec library. SSVC-style framing: exploitation status is 'none/public write-up', automatable is unlikely (needs a crafted file opened by a victim), and technical impact is partial (availability only).

An attacker crafts a malicious Dirac video stream containing a low-delay picture whose slice_bytes_denom or slice count is zero, then distributes it (e.g., as a media file or network stream) to a victim running an application that decodes Dirac via libschroedinger ≤1.0.11. When the victim opens or processes the stream, the decoder performs a division using the attacker-controlled zero denominator, raising a SIGFPE and crashing the application. No public weaponized exploit is identified, though a detailed technical write-up of the vulnerable parsing path is publicly available.