A divide‑by‑zero fault in the function tta_decoder_init_get_info() allows an attacker to craft a .tta file containing a zero sample rate. When the library processes this file and verifies a recomputed header CRC32, the division by zero triggers a SIGFPE, causing the program to terminate. This results in a denial of service rather than a remote code execution or privilege escalation. The vulnerability is a classic Divide by Zero flaw (CWE‑369).

Any system that uses True Audio’s libtta library in a version up to 2.3 is affected, including the bundled tta console tool and any third‑party applications that link against this library. The issue is independent of operating system and can affect Linux, Windows, macOS, or any environment where the library is deployed.

The CVSS score of 6.8 indicates moderate severity. EPSS information is not available and the vulnerability is not catalogued in CISA’s KEV list. The most likely exploitation path involves the attacker supplying a malicious .tta file, either locally or over a network if the application accepts media from remote sources. Because the flaw only causes a crash, it is a high‑impact denial of service vector but does not allow an attacker to execute arbitrary code or gain privileges.