KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8745-1 advisory.

    It was discovered that KissFFT incorrectly handled certain large Fourier transform sizes on 32-bit     architectures. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial     of service, or execute arbitrary code. (CVE-2025-34297)

    It was discovered that KissFFT incorrectly handled certain multidimensional Fourier transform sizes. An     attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or     execute arbitrary code. (CVE-2026-41445)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4715 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4715-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     August 02, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : kissfft     Version        : 131.1.0-1+deb11u1     CVE ID         : CVE-2025-34297 CVE-2026-41445


    Two issues have been found in kissfft, a mixed-radix Fast Fourier     Transform library. The issues are related to integer overflows.



    For Debian 11 bullseye, these problems have been fixed in version     131.1.0-1+deb11u1.

    We recommend that you upgrade your kissfft packages.

    For the detailed security status of kissfft please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/kissfft

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc()     function in kiss_fftndr.c where the allocation size calculation     dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being     widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer     overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes     beyond the allocated buffer region when kiss_fftndr() processes the data. (CVE-2026-41445)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
344781	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : KissFFT vulnerabilities (USN-8745-1)	Nessus	Ubuntu Local Security Checks	Local	high
331649	Debian dla-4715 : kissfft-tools - security update	Nessus	Debian Local Security Checks	Local	high
307652	Linux Distros Unpatched Vulnerability : CVE-2026-41445	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-41445

high

Tenable Plugins

high

high

high