{"schema":"threatline.record/2","record":{"id":"CVE-2026-112007","aliases":[],"summary":"Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader","details":"Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.","categories":["Unclassified"],"product":"Schism Tracker","vendor":"schismtracker","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112007","source_modified_at":"2026-10-19T16:38:41.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Schism Tracker","vendor":"schismtracker","versions":[{"version":"0","lessThanOrEqual":"20260524","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0013,"percentile":0.0236,"score_date":"2026-10-23"},"published_at":"2026-10-18T11:38:30.590Z","modified_at":"2026-10-19T16:38:41.739Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112007","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T16:38:41.739Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112007","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haindpwn/schismtracker-ult-sample-count-oob-write","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/schismtracker/schismtracker/blob/74215ae300b555928332e03152dfcdc898f96ca6/fmt/ult.c#L319-L330","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/schismtracker/schismtracker","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/schism-tracker-through-20260524-heap-out-of-bounds-write-via-ult-loader","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-19T15:57:49.914519Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-19T16:38:41.739Z","content_hash":"a1aa9cf42ae42e4322f78d6b9fa3c560a3e8e86c7893279aa2fb9a94ea2df742"}}