CVE-2026-41445 Details
Description
KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.
A heap-based buffer overflow vulnerability has been identified in KissFFT versions prior to commit 8a8e66e. The issue arises from an integer overflow in the 'kiss_fftndr_alloc()' function within 'kiss_fftndr.c'. The vulnerability allows attackers to trigger a heap buffer overflow by providing crafted dimensions that cause the allocation size calculation to exceed the maximum value of a signed 32-bit integer. This overflow occurs before the value is converted to 'size_t', resulting in 'malloc()' allocating a buffer that is too small. Consequently, when 'kiss_fftndr()' processes the data, it can write beyond the allocated buffer, leading to potential exploitation.
Users can update to KissFFT commit 8a8e66e or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |