CVE-2025-34297
HIGH EPSS 4.7%
Published Dec 1, 20257mo ago · Modified Jun 17, 20262w ago
8.6 CVSS 4.0
Published Dec 1, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago
Description
KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
4.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-190 Integer Overflow or Wraparound Numeric Error
References 3
- github.com https://github.com/mborgerding/kissfft/commit/1b08316582049c3716154caefc0deab8758506e3
- github.com https://github.com/mborgerding/kissfft/issues/120
- vulncheck.com https://www.vulncheck.com/advisories/kissfft-integer-overflow-heap-buffer-overflow
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.