{"id":"CVE-2026-100493","kind":"vulnerability","aliases":["CVE-2026-100493"],"related":[],"title":"AMD Compressonator SDK: crafted DDS file can crash process or leak heap memory","description":"An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.","summary":"AMD Compressonator SDK's DDS RGB888 loader has an integer overflow that allocates too little heap memory when given a crafted DDS file. The resulting out-of-bounds read can terminate the process or disclose limited heap memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd","c++","compressonator","image-processing","package"],"not_affected_if":["no-dds-loading","trusted-input-only"],"how_to_check":"- Check whether your application links the Compressonator SDK and loads DDS files with it; the sources do not name affected versions, so `unknown` for version ranges\n- Confirm whether untrusted users can supply DDS files to the loader","fix":null,"status":"open","published_at":"2026-11-03T15:17:19+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","triaged_at":"2026-11-03T15:23:14+00:00","updated_at":"2026-11-03T15:23:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:23:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"AMD Compressonator SDK: crafted DDS file can crash process or leak heap memory","impact":"medium","summary":"AMD Compressonator SDK's DDS RGB888 loader has an integer overflow that allocates too little heap memory when given a crafted DDS file. The resulting out-of-bounds read can terminate the process or disclose limited heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["compressonator","amd","image-processing","c++"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process crashes or limited heap memory is disclosed to the attacker","analyst_note":"Find affected and fixed SDK versions and the advisory text from NVD and AMD's security bulletin; the sources given state neither.","how_to_check":"- Check whether your application links the Compressonator SDK and loads DDS files with it; the sources do not name affected versions, so `unknown` for version ranges\n- Confirm whether untrusted users can supply DDS files to the loader","plain_action":"","needs_analyst":true,"not_affected_if":["no-dds-loading","trusted-input-only"],"who_is_affected":"Applications that use the AMD Compressonator SDK to load DDS images, especially where the files come from untrusted sources. Systems that never load DDS files through this SDK can skip it. The sources do not list affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4131,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100493':16A,19A '-2026':15A,18A 'alloc':39B,93C 'allow':79C 'amd':1A,20B,27B,75C 'attack':81C 'bound':55B,100C 'c':21B 'caus':89C 'compresson':2A,22B,28B,76C 'could':78C 'craft':4A,47B,85C 'crash':8A 'cve':14A,17A 'dds':5A,31B,48B,71C,86C 'disclos':62B 'disclosur':109C 'file':6A,49B,87C 'given':45B 'heap':12A,42B,64B,92C,111C 'imag':24B 'image-process':23B 'integ':36B,67C 'leak':11A 'limit':63B,108C 'littl':41B 'loader':33B,73C 'memori':13A,43B,65B,112C 'out-of-bound':52B,97C 'overflow':37B,68C 'packag':26B 'potenti':102C 'process':9A,25B,60B,105C 'read':56B,101C 'result':51B,103C 'rgb888':32B,72C 'sdk':3A,29B,77C 'subsequ':96C 'suppli':83C 'termin':58B,106C 'unders':91C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the AMD Compressonator SDK to load DDS images, especially where the files come from untrusted sources. Systems that never load DDS files through this SDK can skip it. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amd","c","compressonator","imageprocessing","medium","package"],"first_public_at":"2026-11-03T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@amd.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100493","severity":null,"published_at":"2026-11-03T15:17:19+00:00","modified_at":"2026-11-03T15:17:19+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","fetched_at":"2026-11-03T15:21:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}