AMD Compressonator SDK EUVD-2026-115880

Exploitation requires the victim to load/process an attacker-crafted DDS file through the RGB888 code path of the AMD Compressonator SDK's DDS loader; the CVSS vector's UI:P confirms required (passive) user interaction and AV:L confirms a local, file-delivery vector rather than remote triggering. No privileges are required (PR:N) and no special non-default configuration is named in the description beyond use of the RGB888 DDS loader. Limiting factors: the attacker cannot trigger it without the victim opening the malicious file, there is no network-facing exposure, and the realistic outcome is confined to a process crash or limited heap-memory disclosure - no integrity impact and no code execution are indicated in the available sources.

This is a medium-severity, local file-parsing issue rather than a high-urgency network threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L) describes a local attack vector requiring passive user interaction - the victim must open or process a crafted DDS file - not remote, unauthenticated reach. Although PR:N means no privileges are needed, AV:L plus UI:P substantially limits mass exploitation. The impact is bounded: high confidentiality (VC:H, heap memory disclosure via out-of-bounds read) but no integrity impact and only limited availability impact (VA:L, process termination); the CWE-190 integer overflow leads to an undersized heap allocation and OOB read, with no indication of code execution in the available sources. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the supplied data, so there is no evidence of active or probable exploitation. The vuln.today decision label is 'this_month', consistent with a real but non-emergency priority. Net: a legitimate bug to patch on a normal cadence, not a drop-everything issue; its real-world risk is further tempered by the niche developer-tooling footprint of the affected SDK. One mismatch worth verifying with the vendor: the description calls the leak 'limited disclosure of heap memory', yet the vendor vector rates confidentiality as VC:H.

An attacker crafts a malicious DDS texture file and gets it to a target - for example as a downloaded game or graphics asset - relying on the victim to process it with software built on the AMD Compressonator SDK's RGB888 DDS loader. When loaded, the integer overflow produces an undersized heap allocation and a subsequent out-of-bounds read, crashing the process or leaking adjacent heap memory. No public exploit was identified at time of analysis.