CVE-2026-41445 KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()
Attackers can trigger heap buffer overflow via integer overflow in KissFFT, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41445?
CVE-2026-41445 is a high-severity vulnerability in mborgerding kissfft, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.
Which versions are affected by CVE-2026-41445?
Linux distribution packages (1)
kissfft openSUSE:Tumbleweed | All versions | 131.2.0-2.1 |
How do I fix CVE-2026-41445?
Apply the vendor's patch.
Is CVE-2026-41445 being exploited?
There is no known exploitation of CVE-2026-41445 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-41445, GHSA-xpr7-5899-f5vj, UBUNTU-CVE-2026-41445, openSUSE-SU-2026:10591-1.