CVE-2026-112007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112007
Downstream
Published
2026-10-18T11:38:30Z
Modified
2026-10-20T02:30:22Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
Details

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112007.json"
}
References

Affected packages

Git / github.com/schismtracker/schismtracker

Affected ranges

Type
GIT
Repo
https://github.com/schismtracker/schismtracker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
74215ae300b555928332e03152dfcdc898f96ca6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "20260524"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
20160521
20160913
20170420
20170910
20180209
20180513
20180810
20181223
20190614
20190722
20190805
20200412
20211115
20211116
20220125
20220506
20220807
20220905
20221020
20221201
20230906
20231029
20240129
20240328
20240409
20240426
20240503
20240515
20240523
20240529
20240609
20240614
20240630
20240809
20241021
20241225
20241226
20250202
20250208
20250305
20250307
20250313
20250415
20250728
20250825
20251014
20260524
deploy-test-1
deploy-test-2
deploy-test-3
deploy-test-4
deploy-test-5
deploy-test-6
hg-import
macosx-deploy-test
sdl1
issue-175.*
issue-175.0
issue-175.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112007.json"