CVE-2026-112054 in Libschroedinger
Summary
by MITRE • 10/18/2026
Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified within the libschroedinger library, specifically affecting versions up through 1.0.11, represents a critical arithmetic error that leads to application instability and potential denial of service conditions. This flaw is rooted in improper input validation during the parsing of Dirac video stream data. The core technical issue involves a division by zero operation triggered when specific parameters within the encoded media file are manipulated maliciously. When an attacker supplies crafted input containing a zero value for slice_bytes_denom or an invalid slice count, the decoder attempts to perform arithmetic operations that assume non-zero denominators. This mathematical inconsistency results in a fatal signal being raised by the operating system, specifically SIGFPE (Floating Point Exception), which abruptly terminates the executing process without graceful error handling.
From a technical perspective, this vulnerability is exploited through the parsing functions schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data. These components are responsible for interpreting metadata and structural information within low-delay picture frames of Dirac streams. By carefully constructing a malicious media file where these fields contain zero or otherwise invalid values that lead to division by zero, an attacker can force the decoder into an unrecoverable state. The impact is immediate application crash, which constitutes a denial of service against any software relying on libschroedinger for video decoding tasks. This includes multimedia players, streaming applications, and automated media processing pipelines that ingest untrusted or semi-trusted content without rigorous pre-validation.
The classification of this vulnerability aligns with CWE-369, Divide By Zero, which describes a situation where an application performs division by zero due to insufficient validation of input data. In the context of attack vectors, this flaw can be leveraged for remote code execution if combined with other memory corruption vulnerabilities in adjacent components, though primarily it serves as a reliable denial-of-service vector. It maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or application crash via malformed input. The lack of bounds checking and arithmetic safety checks allows external actors to disrupt service availability with minimal effort, requiring only the delivery of a specially crafted video file.
Mitigation strategies for this vulnerability primarily involve updating libschroedinger to version 1.0.12 or later where these parsing routines have been hardened against such inputs. For systems unable to update immediately, implementing input sanitization at the application layer is recommended. This includes validating slice_bytes_denom and slice count values before they are passed to the decoder functions, ensuring that zero values are rejected or handled safely without triggering arithmetic exceptions. Additionally, deploying media analysis tools that inspect incoming streams for structural anomalies can help detect and block malicious payloads before they reach vulnerable decoding components. Organizations should also consider implementing sandboxing mechanisms for video processing services to limit the blast radius of potential crashes caused by such malformed inputs.