CVE-2026-110605
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with units
CVSS
5.5
Medio
EPSS
0.2%
p9
KEV
—
Exploit Today
3
0-100
Publicado: 14 oct 2026 · Última mod.: 16 oct 2026 · CWE-369
0.2%EPSS · 30 días0.2%
2026-10-152026-10-20
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
- github.comhttps://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L1422-L1503
- github.comhttps://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L542
- github.comhttps://github.com/tomolt/libschrift/issues/46
- hackmd.iohttps://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libschrift-through-0.10.2-divide-by-zero-via-unitsperem-in-draw-line
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1120545.5 MED1.7%
——1Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.2dCVE-2026-1120135.5 MED2.3%
——1libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.2dCVE-2025-556535.5 MED4.4%
——1GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.22hCVE-2026-1071596.5 MED14.2%
——4MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.14dCVE-2026-1052504.3 MED23.5%
——7A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.15dCVE-2026-1018873.5 BAJ4.0%
——1BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.20d