# CVE-2026-40652: AMD Compressonator SDK out-of-bounds read in TGA parser

Source: https://junglewise.ai/threats/cve-2026-40652-an-out-of-bounds-read-condition-in-the-amd-compressonator-sdk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-40652 · Severity: info · Published 2026-11-03

The AMD Compressonator SDK, a graphics processing toolkit, contains an out-of-bounds memory read vulnerability when parsing specially crafted TGA image files. An attacker with local access could exploit this to read sensitive data from memory or crash the application. This affects users and automated image processing pipelines that use the SDK.

Technologies: [Amd Compressonator SDK](https://junglewise.ai/threats/technologies/compressonator-sdk). Vendors: [Amd](https://junglewise.ai/threats/vendors/amd).

## Quick answers

**Is CVE-2026-40652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40652 being exploited in the wild.

**How severe is CVE-2026-40652?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** AMD Compressonator SDK.

**Is there a fix for CVE-2026-40652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40652 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-40652?** Check whether you run Amd Compressonator SDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read in the TGA file parser allows reading past buffer boundaries, potentially exposing heap memory contents. The vulnerability requires local access and a specially crafted TGA file, and can result in information disclosure or denial of service depending on memory layout and application context.

## Affected products

- AMD Compressonator SDK

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html](https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html)

## Related threats

- [AMD Compressonator SDK out-of-bounds write in DDS file handling](https://junglewise.ai/threats/cve-2026-40661-an-out-of-bounds-write-oow-condition-in-the-amd-compressonator)
- [AMD Compressonator SDK heap-based out-of-bounds read](https://junglewise.ai/threats/cve-2026-40660-a-heap-based-out-of-bounds-oob-read-vulnerability-in-the-amd)
- [AMD Compressonator SDK integer overflow in DDS parsing](https://junglewise.ai/threats/cve-2026-40659-an-integer-overflow-condition-in-the-amd-compressonator-sdk-could)
- [AMD Compressonator SDK integer overflow in DDS RGB888 loader](https://junglewise.ai/threats/cve-2026-100493-an-integer-overflow-in-the-dds-rgb888-loader-of-amd)