PT-2026-33804 · Mborgerding · Kissfft

Sajeeb Lohani + 1 · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-41445

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss fftndr alloc() function in kiss fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss fft scalar) overflows signed 32-bit integer arithmetic before being widened to size t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT MAX, allowing writes beyond the allocated buffer region when kiss fftndr() processes the data.

Fix

Heap Based Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-122

CWE-190

Related Identifiers

CVE-2026-41445

Affected Products

Kissfft

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41445 · Security Note
• https://github.com/mborgerding/kissfft/commit/8a8e66e33d692bad1376fe7904d87d767730537f · Patch
• https://vulncheck.com/advisories/kissfft-integer-overflow-heap-buffer-overflow-via-kiss-fftndr-alloc · Note