CVE-2026-112053 in Schroedinger
Summary
by MITRE • 10/18/2026
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The libschroedinger library, specifically versions up through 1.0.11, contains a critical out-of-bounds read vulnerability that poses significant risks to multimedia processing systems and video playback applications. This flaw resides within the core decoding logic responsible for handling Dirac streams, which are commonly used in professional video production and broadcasting environments due to their high-quality compression capabilities. The vulnerability is triggered when the library processes unvalidated input parameters related to wavelet filtering operations. Specifically, attackers can exploit this weakness by supplying crafted low-delay Dirac stream files that contain invalid metadata values for either the wavelet filter index or the transform depth. When these malformed inputs are processed, the decoder attempts to access memory locations beyond the boundaries of a static quantizer table, leading to an out-of-bounds read condition.
From a technical perspective, the root cause lies in insufficient input validation during the initialization and execution phases of the wavelet filter algorithm. The library fails to verify that the provided wavelet filter index is within the acceptable range before using it as an offset or pointer into internal data structures. Similarly, the transform depth parameter is not adequately constrained against known valid limits for static quantizer tables. In standard operation, a wavelet filter index should typically be less than 7 and a transform depth should remain below 5 to ensure safe memory access patterns. However, when an attacker provides a wavelet filter index of seven or higher, or a transform depth of five or six, the application attempts to read from memory addresses that are not allocated for this purpose. This behavior constitutes a classic buffer over-read vulnerability where sensitive data may be exposed or program execution flow is disrupted due to invalid memory access patterns.
The operational impact of this vulnerability extends beyond simple denial-of-service scenarios. While crashing decoding applications is a primary and immediate consequence, the ability to read past static boundaries can potentially lead to information disclosure if adjacent memory contains sensitive data such as cryptographic keys, user credentials, or other proprietary algorithmic parameters. Furthermore, in complex multimedia pipelines, an unexpected crash during video playback can cause instability in host systems, particularly those relying on continuous media processing for critical operations. Attackers could deliver maliciously crafted Dirac stream files through various vectors including email attachments, web-based media players, or networked storage devices where the file is automatically processed by vulnerable software components. This makes the vulnerability particularly dangerous in environments where untrusted video content might be ingested without rigorous sanitization checks.
This issue aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes out-of-bounds read vulnerabilities resulting from improper validation of array indices or buffer sizes. Additionally, it relates to CWE-20 regarding improper input validation, as the core failure is the lack of rigorous boundary checking on user-supplied parameters before they are used in memory access operations. From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates initial exploitation techniques associated with invalid resource manipulation and potentially information exfiltration if the read data can be leveraged for further attacks. The attack vector is generally classified as remote via networked file delivery or local execution if an attacker has access to trigger the decoding process on a targeted system.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Organizations should immediately update libschroedinger to version 1.0.12 or later, where this validation flaw has been addressed by developers implementing strict range checks for wavelet filter indices and transform depths before they are used in memory access routines. For systems that cannot be updated promptly, deploying input filtering mechanisms at the application layer can help block malformed Dirac streams from reaching the vulnerable library components. Security teams should also consider enabling core dump analysis tools to detect potential exploitation attempts and monitor system logs for unusual crashes associated with media processing services. Furthermore, adopting static code analysis tools during software development lifecycles can help identify similar input validation gaps in other multimedia libraries before they are deployed into production environments.