CVE-2026-112053
Description
A flaw was found in schroedinger. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the decoding application. By tricking a user into opening a specially crafted Dirac video stream with invalid parameter values, an attacker can trigger an out-of-bounds read, resulting in abnormal application termination.
Statement
An out-of-bounds read exists in the libschroedinger low-delay Dirac decoder (schro_params_set_default_quant_matrix indexing schro_tables_lowdelay_quants[7][4][9] with an unvalidated wavelet_filter_index and transform_depth). No Red Hat product streams ship schroedinger (0 RH-scoped newtopia hits); Fedora and EPEL community streams ship the affected final release 1.0.11. No upstream fix exists (project abandoned since 2012, unsupported-when-assigned). Impact is a reliable crash (DoS) only - no OOB write, no info disclosure (values clamped 0-60), no code execution.
Mitigation
Avoid decoding untrusted Dirac streams; no upstream fix is available or forthcoming. Community maintainers may carry the writeup's proposed downstream patch (reject filter index >= SCHRO_N_WAVELETS, clamp depth column to 0-3, reject zero slice denominators) or mark wontfix given the abandoned upstream.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
