CVE-2026-41445CWE-122CWE-190

KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()

High · published April 20, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00478 · 40.3th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-190 · Integer Overflow or Wraparound
Published
2026-04-20T16:18Z
EPSS history
Timeline
  • 20 APR 16:18Z
    KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()
    cvelistv5