CVE-2025-34297 & CVE-2026-41445: Debian LTS KissFFT Integer Overflow Remediation

The Debian Long Term Support (LTS) team has released a critical security advisory, DLA-4715-1, addressing two high-severity integer overflow vulnerabilities in the kissfft (Keep It Simple, Stupid Fast Fourier Transform) library. Assigned CVE-2025-34297 and CVE-2026-41445, these flaws specifically impact Debian 11 "Bullseye".

For defenders, this is a classic supply-chain risk scenario. While kissfft is a mathematical library rather than a network service, it is ubiquitously embedded in applications handling signal processing—from audio compression to Software Defined Radio (SDR). If a front-end service processes untrusted input and passes it to the vulnerable FFT functions, attackers can trigger memory corruption. Immediate validation of patch deployment across your Linux fleet is required to prevent potential Denial of Service (DoS) or arbitrary code execution scenarios.

Technical Analysis

Affected Products & Versions:

OS: Debian 11 (Bullseye) LTS
Package: kissfft (source) and associated binary packages (e.g., libkissfft-dev, libkissfft*-131.1.0)
Vulnerable Version: Versions prior to 131.1.0-1+deb11u1

Vulnerability Mechanics: Both CVE-2025-34297 and CVE-2026-41445 are classified as integer overflows. In the context of FFT operations, libraries must dynamically allocate memory buffers based on input parameters (such as the number of samples or frequency bins).

The Flaw: The arithmetic logic used to calculate buffer sizes fails to account for integer wrapping. When an attacker supplies a specifically crafted malicious input (e.g., a large integer value representing signal dimensions), the size calculation wraps around to a small positive number.
The Exploit: The system allocates a buffer that is too small to hold the actual data. Subsequent write operations overflow the buffer boundaries, corrupting the heap.
Impact: Successful exploitation leads to heap memory corruption. Depending on the application's error handling and memory layout, this results in application crashes (DoS) or, in worst-case scenarios, Remote Code Execution (RCE) if the attacker can control the data written into the overflowed region.

Exploitation Status: As of this advisory publication, there are no confirmed reports of active exploitation in the wild for CVE-2025-34297 or CVE-2026-41445. However, the complexity of triggering these bugs is low for any application exposing the API to user input. Defenders must assume proof-of-concept (PoC) code will be available shortly given the public release of fix details.

Detection & Response

Identifying the presence of vulnerable libraries in a Linux environment requires checking installed package versions and monitoring for patch deployment activities.

SIGMA Rules

YAML

---
title: Debian KissFFT Package Installation via APT/DPKG
id: 4a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the installation or update of the kissfft package on Debian systems via apt or dpkg. This assists in verifying remediation for CVE-2025-34297 and CVE-2026-41445.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4715-1-kissfft
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/dpkg'
      - '/apt-get'
      - '/apt'
    CommandLine|contains:
      - 'kissfft'
falsepositives:
  - Legitimate administrative software updates
level: low
---
title: Potential Exploitation - KissFFT Library Crash Events
id: 5b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential exploitation attempts via segmentation faults in processes linked to kissfft. Requires Syslog or Auditd ingestion.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4715-1-kissfft
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  product: linux
  service: syslog
detection:
  selection:
    process|contains: 'kissfft'
    msg|contains:
      - 'segfault'
      - 'segmentation fault'
      - 'general protection fault'
  condition: selection
falsepositives:
  - Application instability unrelated to exploitation
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for installation of kissfft packages on Linux endpoints
// Assumption: Linux logs are ingested via Syslog or CEF into Syslog table
Syslog
| where ProcessName contains "dpkg" or ProcessName contains "apt"
| where SyslogMessage has "kissfft"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for Debian systems with vulnerable kissfft packages installed
-- This executes dpkg -l to list installed packages and filters for kissfft
SELECT * FROM execve(argv=["bash", "-c", "dpkg -l | grep kissfft"])

Remediation Script

Bash / Shell

#!/bin/bash
# Remediation script for CVE-2025-34297 & CVE-2026-41445
# Updates kissfft to version 131.1.0-1+deb11u1 on Debian 11

if [ "$(id -u)" -ne 0 ]; then
  echo "This script must be run as root"
  exit 1
fi

echo "Updating package lists..."
apt-get update -y

echo "Upgrading kissfft to patched version 131.1.0-1+deb11u1..."
# Using -t to target bullseye-security explicitly if LTS repos are configured specifically
apt-get install -y -t bullseye-security kissfft

echo "Verifying installed version..."
dpkg -l | grep kissfft

echo "Remediation complete."

Remediation

Update Immediately: Apply the security update provided by Debian LTS to upgrade kissfft to version 131.1.0-1+deb11u1. This version contains the necessary bounds checks to prevent the integer overflow conditions.
Verification: After patching, verify the installation using the following command: bash dpkg -l | grep kissfft

Ensure the output reflects version 131.1.0-1+deb11u1.
Service Restart: While the library itself is just a collection of object files, any running services or daemons linking against kissfft (such as audio servers, SDR software, or custom scientific applications) must be restarted to load the patched shared memory objects.
Official Advisory: Refer to the Debian LTS Advisory DLA-4715-1 for full package details and repository configuration instructions.
Asset Inventory: If you are running Debian 11, perform an internal scan to identify all workloads and containers utilizing kissfft. Since this is often a dependency pulled in by other software, your dependency tree analysis (SBOM) should highlight applications that require a restart.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub