Read the docs
TI-2026-76181 Aliases CVE-2026-112053GHSA-6hwf-vcvv-9jh9

Out-of-bounds read in Schroedinger libschroedinger

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read (CWE-125) in schro_params_set_default_quant_matrix. Unvalidated wavelet filter index or transform depth values let the read go past a static quantiser table. A local attacker with no privileges can deliver a crafted low-delay Dirac stream that crashes decoding applications when a user processes it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schroedingerschroedingerup to 1.0.11—No fix listedCNA
  • schroedinger VendorSchroedinger Affected up to 1.0.11 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for schroedinger.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112053
  2. 2026-10-18 Alias added: GHSA-6hwf-vcvv-9jh9
  3. 2026-10-19 Priority changed: MEDIUM → LOW
  4. 2026-10-20 CISA SSVC decision points changed
  5. 2026-10-20 Priority changed: LOW → MEDIUM
  6. 2026-10-22 Affected versions changed · Red Hat
  7. 2026-10-22 CVSS score added · Red Hat

References

Advisory 1

Other 1

  • TI-2026-76182 Divide by zero in libschroedinger low-delay transform parsing CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences