CVE-2026-40661
MediumCVSS 5.2Summary
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This may result in heap corruption or denial of service (DoS).
Risk Assessment
Processing a malicious DDS file may cause memory corruption and application crashes, potentially enabling further exploitation.
Recommendation
Update the AMD Compressonator SDK to a patched version. Avoid processing untrusted DDS files in automated pipelines.
Other vulnerabilities in AMD Compressonator SDK
See all- CVE-2026-40660Medium
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory. This may result in information disclosure or application crash.
- CVE-2026-40659Medium
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file. This may result in denial of service (DoS).
- CVE-2026-40652Medium
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline. This may result in disclosure of sensitive heap memory contents or denial of service.
- CVE-2026-100493Medium
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.
Original NVD description (English source)
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in heap corruption or denial of service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS