The vulnerability in mborgerding kissfft (CVE-2026-41445) is an integer overflow in the kiss_fftndr_alloc() function within kiss_fftndr.c. The calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being converted to size_t, causing malloc() to allocate less memory than needed. This results in a heap buffer overflow when kiss_fftndr() processes data with specially crafted dimensions that cause the multiplication to exceed INT_MAX. The issue affects versions prior to commit 8a8e66e.

An attacker can trigger a heap buffer overflow by providing crafted input dimensions that exploit the integer overflow in the allocation size calculation. This may lead to memory corruption, potentially allowing arbitrary code execution or denial of service. The CVSS 4.0 score of 8.7 indicates high impact with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid processing untrusted or specially crafted input dimensions with affected versions of kissfft.