EUVD-2026-115876
GHSA-hgmv-p82r-p566
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access or file delivery path
-
ExploitSupply crafted DDS file to Compressonator SDK
-
ExecutionTrigger integer overflow during DDS parsing
-
ImpactCrash application causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the host and that the AMD Compressonator SDK (or an application built on it) parse an attacker-supplied, specially crafted DDS file; the CVSS 4.0 vector indicates low privileges (PR:L) and passive user interaction (UI:P), meaning a local user or process must actually load/process the malicious file rather than it executing automatically. Exploitation is limited to denial of service - there is no confidentiality or integrity impact (VC:N/VI:N) - and the attack surface is confined to workflows that ingest untrusted DDS files through this SDK, which constrains realistic exposure. No network vector exists (AV:L). |
| Impact | This is a medium-severity, availability-only issue, not a high-priority emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P, VC:N/VI:N/VA:H) describes a locally-triggered denial of service that requires low privileges on the host and passive user interaction (a user must process the malicious file); confidentiality and integrity are explicitly unaffected. No EPSS score, KEV listing, or PoC/exploit reference is present in the supplied intelligence, so exploitation probability signals are absent rather than low. The vuln.today decision label is 'this_month' (routine patch-cycle priority), which is consistent with a local DoS against a developer-facing SDK. Taken together the signals are coherent and point to limited real-world risk: no network exposure, no code execution, and no evidence of exploitation. The main open question is deployment context - the impact is confined to any application or pipeline that parses untrusted DDS files through the Compressonator SDK. |
| Exploit ScenarioDerived | An attacker who can place a file where a Compressonator-based tool or pipeline will process it supplies a specially crafted DirectDraw Surface (DDS) file; when a local user or process loads it, an integer overflow (CWE-190) is triggered and the parsing application crashes, causing denial of service. No public exploit code is identified in the available data, and the exact overflow trigger is not described in the sources. Exploitation requires local access and that a user actually process the malicious file (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Denial of service in the AMD Compressonator SDK affects applications that parse untrusted DirectDraw Surface (DDS) files, where an integer overflow can crash or hang the consuming process when a local attacker supplies a crafted file. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:P/VA:H, with VC:N and VI:N) means a local user or process with low privileges must actually load or process the malicious asset; there is no confidentiality or integrity impact and no network vector. No public exploit code or CISA KEV entry is identified in the available data, and the vendor bulletin AMD-SB-6032 is the primary reference; the vuln.today decision label is this_month, consistent with a medium-severity, availability-only issue rather than an emergency.
RemediationAI
The provided data does not include a fixed version or an explicit patch statement, so the authoritative source for updates and version guidance is AMD security bulletin AMD-SB-6032 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html); apply the vendor-supplied SDK update once the advisory identifies the corrected release. Because exposure is limited to workflows that ingest untrusted DDS files through this SDK, the practical mitigation is to avoid parsing DDS content from untrusted or unverified sources with Compressonator-based tooling, or to perform such processing in a low-privilege, isolated process so that a crash or hang affects only the parsing context; this reduces availability impact but does not address the underlying integer overflow, and it constrains functionality for legitimate but untrusted texture inputs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-190 (Integer Overflow or Wraparound) in the AMD Compressonator SDK is triggered while processing a specially crafted DirectDraw Surface (DDS) file, a container format commonly used to store texture and image data. The available sources state only that an integer overflow condition leads to denial of service; the precise arithmetic path, the field or size calculation that overflows, and the resulting failure mode (for example undersized allocation versus out-of-bounds access) are not described in the supplied evidence. No CPE strings were provided, so exact affected builds cannot be enumerated from the input, and the CVSS 4.0 vector indicates local attack (AV:L), low privileges (PR:L), and passive user interaction (UI:P), with high availability impact only (VA:H, VC:N, VI:N). The independent assessment maps this to CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. Realistic exposure is confined to workflows in which the SDK or an application built on it ingests DDS files from untrusted sources.
Know when Amd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local supply of a crafted DDS file (AV:L) that a privileged local user must process (PR:L/UI:R), causing only a crash, so C:N/I:N and A:H.
Primary rating from Vendor (amd).
CVSS VectorVendor: amd
DescriptionCVE.org
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
Exploit-DB