CVE-2026-112012: Out-of-bounds Write in True Audio libtta

The vulnerability in libtta versions up to 2.3 arises because the functions tta_decoder_process_stream() and tta_decoder_process_frame() do not properly reject .tta files with a zero channel count in their headers. This allows attackers to supply a specially crafted .tta file that causes the decoder to access memory at cache[-1], resulting in stack memory corruption. The issue is due to missing validation checks on the channel count header field, leading to out-of-bounds read and write operations on the stack during audio decoding.

Exploitation of this vulnerability can cause stack memory corruption in applications using libtta for decoding .tta audio files. This may lead to application crashes or potentially undefined behavior. The CVSS score of 4.8 (medium severity) reflects limited attack vector (local), low complexity, and limited impact on confidentiality, integrity, and availability. There are no known exploits in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted .tta files or implement additional input validation to reject files with zero channel counts.