CVE-2025-34297

HighCVSS 8.6

Published: 01/12/2025(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

In KissFFT versions prior to the fix commit 1b083165, an integer overflow exists in kiss_fft_alloc() in kiss_fft.c on 32-bit platforms. The nfft parameter is not validated before being used in a size calculation, which can wrap to a small value, leading to an undersized buffer allocation and subsequent heap buffer overflow during initialization.

Risk Assessment

An attacker could exploit this vulnerability to cause application crashes or potentially execute arbitrary code in the process context, posing a risk to system integrity and availability on 32-bit architectures.

Recommendation

Immediately update the KissFFT library to a version containing commit 1b083165 or later, which adds validation of the nfft parameter.

Other vulnerabilities in KissFFT

CVE-2026-41445High
KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger a heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

Original NVD description (English source)

KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.