CVE-2026-40660
MediumCVSS 5.2Summary
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory. This may result in information disclosure or application crash.
Risk Assessment
Potential leakage of process memory data and application instability could facilitate further attacks.
Recommendation
Update the AMD Compressonator SDK to a patched version. Restrict processing of untrusted input files.
Other vulnerabilities in AMD Compressonator SDK
See all- CVE-2026-40661Medium
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This may result in heap corruption or denial of service (DoS).
- CVE-2026-40659Medium
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file. This may result in denial of service (DoS).
- CVE-2026-40652Medium
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline. This may result in disclosure of sensitive heap memory contents or denial of service.
- CVE-2026-100493Medium
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
Original NVD description (English source)
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS