KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4715 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4715-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     August 02, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : kissfft     Version        : 131.1.0-1+deb11u1     CVE ID         : CVE-2025-34297 CVE-2026-41445


    Two issues have been found in kissfft, a mixed-radix Fast Fourier     Transform library. The issues are related to integer overflows.



    For Debian 11 bullseye, these problems have been fixed in version     131.1.0-1+deb11u1.

    We recommend that you upgrade your kissfft packages.

    For the detailed security status of kissfft please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/kissfft

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-55f82da186 advisory.

    Add patch to fix integer overflow on 32-bit in KissFFT (CVE-2025-34297)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ff768f8e37 advisory.

    Add patch to fix integer overflow on 32-bit in KissFFT (CVE-2025-34297)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-291357abab advisory.

    Update to 131.2.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-aeb63d9dfb advisory.

    Update to 131.2.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ecc754cb95 advisory.

    Update to 131.2.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in     kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a     size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large.
    As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop     writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit     architectures. (CVE-2025-34297)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
331649	Debian dla-4715 : kissfft-tools - security update	Nessus	Debian Local Security Checks	Local	high
303922	Fedora 43 : vtk (2026-55f82da186)	Nessus	Fedora Local Security Checks	Local	high
303912	Fedora 42 : vtk (2026-ff768f8e37)	Nessus	Fedora Local Security Checks	Local	high
302989	Fedora 43 : kiss-fft (2026-291357abab)	Nessus	Fedora Local Security Checks	Local	high
302986	Fedora 42 : kiss-fft (2026-aeb63d9dfb)	Nessus	Fedora Local Security Checks	Local	high
302920	Fedora 44 : kiss-fft (2026-ecc754cb95)	Nessus	Fedora Local Security Checks	Local	high
302875	Linux Distros Unpatched Vulnerability : CVE-2025-34297	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-34297

high

Tenable Plugins

high

high

high

high

high

high

high