CVE-2026-112053 Details

A vulnerability allowing out-of-bounds read has been identified in Schroedinger's libschroedinger library, affecting all versions through 1.0.11. The issue arises in the Dirac video codec decoder, where unvalidated wavelet filter index or transform depth values can be exploited. Specifically, an attacker can craft a low-delay Dirac stream that, when decoded, leads to reading past a static quantiser table. This is achieved by setting the wavelet filter index to 7 or higher, or the transform depth to 5 or 6. The vulnerability causes decoding applications to crash.

To address this vulnerability, update the libschroedinger library to a version that includes the necessary checks for wavelet filter index and transform depth values. If no such version is available, consider removing libschroedinger from the application's dependencies.