An integer overflow exists in the DDS RGB888 loader of AMD Compressonator SDK. The overflow leads to an undersized heap allocation and a subsequent out‑of‑bounds read. This can cause the process to terminate or allow an attacker to read a portion of the heap memory, potentially revealing sensitive data. The weakness is a classic example of integer overflow (CWE‑190).

The vulnerability affects the AMD Compressionator SDK; specifically any deployments that load DDS images using the RGB888 loader. No further vendor or product versions are listed, so any installation that includes the affected SDK should be treated as vulnerable.

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires an attacker to provide a crafted DDS file that triggers the overflow; the attack vector is therefore local or remote through a malicious file submitted to the SDK. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited at present. Nevertheless, the vulnerability can lead to denial of service or limited memory disclosure, warranting prompt attention.