CVE-2026-112011
libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer ov
CVSS
5.3
Medio
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 18 oct 2026 · Última mod.: 19 oct 2026 · CWE-190
Sin historial EPSS suficiente todavía.
libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.
- github.comhttps://github.com/gchudov/libtta
- github.comhttps://github.com/gchudov/libtta/blob/af8dc48ce859e98842ab1a3eec98416d22a5199e/libtta.c#L473-L485
- github.comhttps://github.com/gchudov/libtta/blob/af8dc48ce859e98842ab1a3eec98416d22a5199e/libtta.c#L602-L616
- hackmd.iohttps://hackmd.io/@haindpwn/libtta-seek-table-count-overflow-oob-write
- sourceforge.nethttps://sourceforge.net/projects/tta/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libtta-through-2.3-integer-overflow-via-tta-decoder-init-get-info-seek-table
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-101201——
——0A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.5hCVE-2026-1121586.5 MED—
——0A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.18hCVE-2026-1120746.3 MED14.1%
——4A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.21hCVE-2026-1120526.1 MED1.6%
——0libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.17hCVE-2026-624397.0 ALT7.5%
——2A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.18hCVE-2026-624386.1 MED1.6%
——0A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.18h