Integer Overflow Vulnerability in KissFFT by Mborgerding

CVE-2026-41445

What is CVE-2026-41445?

The vulnerability within KissFFT prior to commit 8a8e66e enables an integer overflow in the kiss_fftndr_alloc() function. The flawed calculation for memory allocation can result in a buffer that is too small for the incoming data. When an attacker supplies dimensions that exploit this flaw, the multiplication of parameters may exceed the maximum value of a signed 32-bit integer, leading to a heap buffer overflow. This situation allows for potential data corruption and unauthorized access, highlighting serious risks in handling crafted input scenarios.

References