CVE-2026-112012

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream() and tta decoder process frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.