Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table… (CVE-2026-112053)
Description
Schroedinger libschroedinger versions through 1.0.11 have an out-of-bounds read vulnerability. This flaw occurs when unvalidated wavelet filter index or transform depth values are supplied, allowing attackers to read beyond a static quantiser table. Specifically, crafted low-delay Dirac streams with a wavelet filter index of 7 or more, or transform depth of 5 or 6, can cause decoding applications to crash. The vulnerability has a medium severity rating with a CVSS score of 5.5.
CVSS v3.1
Score 5.5medium
Affected software
pkg:github/distrotech/schroedingerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Schroedinger libschroedinger (up to version 1.0.11) is an out-of-bounds read (CWE-125) caused by improper validation of wavelet filter index or transform depth values. Attackers can exploit this by delivering a specially crafted low-delay Dirac stream with invalid parameters (wavelet filter index >=7 or transform depth 5 or 6), leading to reading past a static quantiser table and crashing the decoding process. This results in denial of service but does not impact confidentiality or integrity.
Potential Impact
Exploitation of this vulnerability can cause denial of service by crashing applications that decode Dirac streams using libschroedinger. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should monitor the vendor advisory for updates. Until a fix is available, avoid processing untrusted low-delay Dirac streams with suspicious wavelet filter index or transform depth values to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6hwf-vcvv-9jh9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-112053"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ad4f5702cdf04f656821217
Added to database: 10/18/2026, 16:36:00 UTC
Last enriched: 10/18/2026, 16:48:26 UTC
Last updated: 10/18/2026, 20:11:55 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.