Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero… (CVE-2026-112054)

The vulnerability in libschroedinger through version 1.0.11 is a divide by zero error (CWE-369) that occurs when an attacker supplies a zero value for slice_bytes_denom or slice count in a Dirac stream. This crafted input is parsed by the functions schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data, which leads to a SIGFPE (floating point exception) and crashes the application, resulting in denial of service. The CVSS 3.1 score is 5.5 (medium severity) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Successful exploitation causes a denial of service by crashing the affected application through a divide by zero error. There is no impact on confidentiality or integrity. The attack requires local access and user interaction.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted Dirac streams or inputs that could trigger the vulnerability.