Live › vulnerability › CVE-2026-40652
An out-of-bounds read in the AMD Compressonator SDK can be triggered by a specially crafted Truevision TGA image file. An attacker who supplies that file to a user or automated pipeline can read sensitive heap memory or cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Exposure requires that the SDK processes TGA files an attacker can supply, such as user uploads or files pulled into an automated image pipeline. Teams that do not use Compressonator or only handle trusted TGA files are unlikely to be affected. Affected versions are unknown from the sources.
No product ranges from the sources yet.
unknown for exact range.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-40652")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.