CVE-2026-100493
MediumCVSS 6.9Summary
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
Risk Assessment
Processing a malicious DDS file may crash the application or leak heap memory data, posing a risk to confidentiality and availability.
Recommendation
Update AMD Compressonator SDK to a patched version and avoid processing untrusted DDS files.
Other vulnerabilities in AMD Compressonator SDK
See all- CVE-2026-40661Medium
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This may result in heap corruption or denial of service (DoS).
- CVE-2026-40660Medium
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory. This may result in information disclosure or application crash.
- CVE-2026-40659Medium
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file. This may result in denial of service (DoS).
- CVE-2026-40652Medium
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline. This may result in disclosure of sensitive heap memory contents or denial of service.
Original NVD description (English source)
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS