Libtta
Monthly
A divide-by-zero in libtta through 2.3 causes an availability-only denial of service: decoding a malformed .tta (True Audio) file whose header declares a zero sample rate triggers a SIGFPE that terminates the host process, including the bundled tta console tool and any third-party application linked against the library. Publicly available exploit code exists - the attacker must recompute the header CRC32 so the corrupt file passes the library's integrity check, then convince a victim to open the file (local vector, user interaction required, PR:N per the supplied vector). Impact is confined to a single-process crash with no privilege gain, code execution, or data disclosure, so real-world priority is low-to-moderate for deployments that actually embed libtta for TTA decoding; no CISA KEV entry is reported for this CVE.
Stack-based out-of-bounds read and write in libtta through 2.3 can corrupt decoder memory when an application processes a crafted .tta file whose header declares zero channels. The flaw is local and requires user interaction-the victim must open or decode the malicious file-so systems that never decode untrusted True Audio input are not exposed; impact is assessed as low confidentiality/integrity/availability, consistent with a crash or constrained stack corruption rather than demonstrated reliable code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and the risk is moderate rather than urgent.
Heap buffer overflow in libtta through 2.3 allows a crafted .tta file to crash 32-bit applications and affect integrity via an integer overflow in the seek-table allocation path. Exploitation requires user interaction to open the malicious audio file and is constrained to 32-bit consumers with specific malformed header values (sample rate 1 and a large samples field); 64-bit builds are not indicated as affected. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation is present in the provided data.
A divide-by-zero in libtta through 2.3 causes an availability-only denial of service: decoding a malformed .tta (True Audio) file whose header declares a zero sample rate triggers a SIGFPE that terminates the host process, including the bundled tta console tool and any third-party application linked against the library. Publicly available exploit code exists - the attacker must recompute the header CRC32 so the corrupt file passes the library's integrity check, then convince a victim to open the file (local vector, user interaction required, PR:N per the supplied vector). Impact is confined to a single-process crash with no privilege gain, code execution, or data disclosure, so real-world priority is low-to-moderate for deployments that actually embed libtta for TTA decoding; no CISA KEV entry is reported for this CVE.
Stack-based out-of-bounds read and write in libtta through 2.3 can corrupt decoder memory when an application processes a crafted .tta file whose header declares zero channels. The flaw is local and requires user interaction-the victim must open or decode the malicious file-so systems that never decode untrusted True Audio input are not exposed; impact is assessed as low confidentiality/integrity/availability, consistent with a crash or constrained stack corruption rather than demonstrated reliable code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and the risk is moderate rather than urgent.
Heap buffer overflow in libtta through 2.3 allows a crafted .tta file to crash 32-bit applications and affect integrity via an integer overflow in the seek-table allocation path. Exploitation requires user interaction to open the malicious audio file and is constrained to 32-bit consumers with specific malformed header values (sample rate 1 and a large samples field); 64-bit builds are not indicated as affected. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation is present in the provided data.