CVE-2026-40652
MediumCVSS 5.2Summary
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline. This may result in disclosure of sensitive heap memory contents or denial of service.
Risk Assessment
Potential disclosure of sensitive memory data and application crashes may impact confidentiality and availability.
Recommendation
Update the AMD Compressonator SDK to a patched version. Avoid processing untrusted TGA files.
Other vulnerabilities in AMD Compressonator SDK
See all- CVE-2026-40661Medium
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This may result in heap corruption or denial of service (DoS).
- CVE-2026-40660Medium
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory. This may result in information disclosure or application crash.
- CVE-2026-40659Medium
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file. This may result in denial of service (DoS).
- CVE-2026-100493Medium
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
Original NVD description (English source)
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS