CVE-2026-41445

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kissfftndralloc() function in kissfftndr.c where the allocation size calculation dimOther(dimReal+2)sizeof(kissfftscalar) overflows signed 32-bit integer arithmetic before being widened to sizet, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INTMAX, allowing writes beyond the allocated buffer region when kissfftndr() processes the data.