CVE-2026-112007 Details
Description
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.
A heap out-of-bounds write vulnerability has been identified in Schism Tracker versions through 20260524. The issue arises in the UltraTracker module loader function fmt_ult_load_song(), located in fmt/ult.c. The vulnerability is caused by the loader failing to properly restrict the one-byte sample count to a maximum of 236 samples. This oversight allows attackers to craft .ult files that, when opened in Schism Tracker, overwrite the instruments pointer array within the song object. This manipulation leads to a crash by causing the application to free pointers chosen by the attacker.
Users can be advised to update to the latest version of Schism Tracker, as this vulnerability has been addressed in the version following 20260524.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Schism Tracker | <= 20260524 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |