{"id":"CVE-2026-40659","kind":"vulnerability","aliases":["CVE-2026-40659"],"related":[],"title":"AMD Compressonator SDK: crafted DDS file causes integer overflow and denial of service","description":"An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).","summary":"The AMD Compressonator SDK has an integer overflow when parsing DirectDraw Surface (DDS) image files. A local attacker who supplies a specially crafted DDS file can crash the program, causing denial of service.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-compressonator","package","texture-processing","windows"],"not_affected_if":["no-dds-processing","trusted-input-only"],"how_to_check":"- Check whether your code or build pipeline depends on the AMD Compressonator SDK (look for Compressonator in your dependencies or build scripts).\n- Confirm the installed SDK version and compare it with the version ranges in the NVD entry; the sources do not list affected versions.","fix":null,"status":"open","published_at":"2026-11-03T15:17:39+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","triaged_at":"2026-11-03T15:24:42+00:00","updated_at":"2026-11-03T15:24:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:24:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMD Compressonator SDK: crafted DDS file causes integer overflow and denial of service","impact":"low","summary":"The AMD Compressonator SDK has an integer overflow when parsing DirectDraw Surface (DDS) image files. A local attacker who supplies a specially crafted DDS file can crash the program, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["amd-compressonator","texture-processing","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Processing crashes, causing denial of service for the affected tool","analyst_note":"Check the AMD security bulletin and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-40659) for affected and fixed versions and whether user interaction is needed.","how_to_check":"- Check whether your code or build pipeline depends on the AMD Compressonator SDK (look for Compressonator in your dependencies or build scripts).\n- Confirm the installed SDK version and compare it with the version ranges in the NVD entry; the sources do not list affected versions.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dds-processing","trusted-input-only"],"who_is_affected":"Teams that run the AMD Compressonator SDK to process DDS texture files, especially where those files come from untrusted or unknown sources. The attacker needs local access to supply the file, so systems that only process trusted assets are lower risk. The sources do not list affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4096,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-40659':16A,19A 'access':76C 'allow':71C 'amd':1A,21B,29B,67C 'amd-compresson':20B 'attack':45B,73C 'caus':7A,57B 'compresson':2A,22B,30B,68C 'condit':64C 'could':70C 'craft':4A,50B,81C 'crash':54B 'cve':14A,17A 'dds':5A,40B,51B,84C 'denial':11A,58B,89C 'directdraw':38B,82C 'dos':92C 'file':6A,42B,52B,85C 'imag':41B 'integ':8A,34B,62C 'local':44B,75C 'overflow':9A,35B,63C 'packag':23B 'pars':37B 'potenti':86C 'process':26B 'program':56B 'result':87C 'sdk':3A,31B,69C 'servic':13A,60B,91C 'special':49B,80C 'suppli':47B,78C 'surfac':39B,83C 'textur':25B 'texture-process':24B 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the AMD Compressonator SDK to process DDS texture files, especially where those files come from untrusted or unknown sources. The attacker needs local access to supply the file, so systems that only process trusted assets are lower risk. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amdcompressonator","medium","package","textureprocessing","windows"],"first_public_at":"2026-11-03T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@amd.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40659","severity":null,"published_at":"2026-11-03T15:17:39+00:00","modified_at":"2026-11-03T15:17:39+00:00","first_seen_at":"2026-11-03T15:22:01+00:00","fetched_at":"2026-11-03T15:22:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}