Skip to content
Fencer Intel
high 8.8

CVE-2026-41445 json

KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()

published 6mo ago modified 14d ago also EUVD-2026-23905

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

Patch / fix

  • kissfft Debian 12 131.1.0-4.1~deb12u1
  • kissfft Debian 13 131.1.0-4.1~deb13u1
  • kissfft Debian 14 131.1.0-4.1

debian advisories DEBIAN-CVE-2026-41445

  • kissfft Ubuntu Pro 22.04 LTS 131.1.0-2ubuntu0.1~esm1
  • kissfft Ubuntu Pro 24.04 LTS 131.1.0-3ubuntu0.1~esm1
  • kissfft Ubuntu Pro 26.04 LTS 131.1.0-4ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-41445

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kissfft openSUSE Tumbleweed 131.2.0-2.1

opensuse advisories openSUSE-SU-2026:10591-1

  • kissfft Alpine 3.24, Alpine 3.23 131.2.0_git20260422-r0

alpine advisories ALPINE-CVE-2026-41445

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-41445 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41445 updated cvss 6.3

KissFFT: KissFFT: Heap buffer overflow via integer overflow in kiss_fftndr_alloc()

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • mborgerding kissfft

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.