CVE-2026-41445

HighCVSS 8.8

Published: 20/04/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger a heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

Risk Assessment

The risk for the organization includes potential remote code execution or system crashes by supplying specially crafted input to applications using the vulnerable version of KissFFT. This could lead to data integrity compromise or service disruption.

Recommendation

Immediately update the KissFFT library to a version containing commit 8a8e66e or later. If an update is not possible, restrict access to applications using KissFFT and validate input data for malicious dimensions.

Other vulnerabilities in KissFFT

CVE-2025-34297High
In KissFFT versions prior to the fix commit 1b083165, an integer overflow exists in kiss_fft_alloc() in kiss_fft.c on 32-bit platforms. The nfft parameter is not validated before being used in a size calculation, which can wrap to a small value, leading to an undersized buffer allocation and subsequent heap buffer overflow during initialization.

Original NVD description (English source)

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.