← Advisories

Excessive KTX2 layer count causes allocation-failure abort in basis_universal

fixed

Details

Product basis_universal
Vendor Binomial LLC
Affected through commit 1b33fd5098c6; fixed in 3454230
CWE CWE-789
Severity medium
Status fixed

Timeline

Found 18 Jul 2026
Reported 18 Jul 2026
Fixed 18 Jul 2026

References

Notes

For KTX2 supercompression formats using per-image slice descriptors, a file-controlled layerCount flowed into an unchecked 32-bit image-count product and the terminating vector resize() path. A small crafted file could request approximately 16 GiB and terminate the process on allocation failure.

Upstream commit 3454230543d5 bounds the layer count, computes the product in 64-bit, validates descriptor bytes against the file before allocation, and uses try_resize(). Independent verification confirmed the PoC is rejected without allocation or abort and all 33 valid KTX2 seeds pass under ASan/UBSan. The fix is on master, newer than v2_10_final_snapshot. Reported and fixed the same day; the maintainer acknowledged and pushed the fix publicly.