USN-8745-1: KissFFT vulnerabilities
Ubuntu released USN-8745-1 fixing two KissFFT flaws that could cause denial of service or arbitrary code execution.
Ubuntu security notice USN-8745-1 fixes CVE-2025-34297, where large Fourier transform sizes on 32-bit architectures are mishandled, and CVE-2026-41445, involving multidimensional Fourier transform sizes. Either issue could crash KissFFT, resulting in denial of service or arbitrary code execution. Users should apply the updated packages.
- Two KissFFT flaws fixed in Ubuntu
- Could cause denial of service or arbitrary code execution
- First flaw affects large transform sizes on 32-bit architectures
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-34297 | KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit | 8.6 | <1% | ||
| CVE-2026-41445 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size… | 8.7 | <1% |
From the original article
It was discovered that KissFFT incorrectly handled certain large Fourier transform sizes on 32-bit architectures. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-34297) It was discovered that KissFFT incorrectly handled certain multidimensional Fourier transform sizes.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.