ANT-2026-1MRWDJYC · simd

integer-underflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-1MRWDJYC: Integer underflow in AVX2 BgraToBgr causing size_t underflow and ~2^61 loop iterations leading to heap buffer overflow

The AVX2 implementation of BgraToBgr performs a subtraction on a size_t value that can underflow. When it does, the result wraps to approximately 2^61 and is then used as a loop iteration count. The pixel-conversion loop consequently runs far beyond the destination buffer, producing a large out-of-bounds heap write.

Target

Project: Simd
Location: BgraToBgr (AVX2)
Discovery: static analysis — not yet dynamically reproduced

Technical Details

A size_t arithmetic operation underflows, wrapping to roughly 2^61. This wrapped value is used as the loop bound for the BGRA→BGR conversion, so the AVX2 store loop writes vastly more data than the destination buffer can hold.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-1MRWDJYC.

Reference: ANT-2026-1MRWDJYC
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: high

ADVISORY

https://github.com/ermig1979/Simd/releases/tag/v7.1.161

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-04-09 Sent to maintainer
2026-05-03 Patch released
2026-05-09 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

65cd97731d71689405fcde298bed051c878e3edeb67f73c88b45b34eb1fe84e35b4af485059b90a6110cca7579d271bb1d4ba2a019a98e37e9815ebb82752b2e

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 13:03 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-1MRWDJYC",
  "bug_class": "Integer Underflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:27+00:00",
  "description": "The AVX2 implementation of BgraToBgr performs a subtraction on a size_t value that can underflow. When it does, the result wraps to approximately 2^61 and is then used as a loop iteration count. The pixel-conversion loop consequently runs far beyond the destination buffer, producing a large out-of-bounds heap write.",
  "discovered_at": null,
  "location": "BgraToBgr (AVX2)",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Simd",
  "reproduction": null,
  "technical_details": "A size_t arithmetic operation underflows, wrapping to roughly 2^61. This wrapped value is used as the loop bound for the BGRA→BGR conversion, so the AVX2 store loop writes vastly more data than the destination buffer can hold.",
  "title": "Integer underflow in AVX2 BgraToBgr causing size_t underflow and ~2^61 loop iterations leading to heap buffer overflow",
  "vendor_severity": "high"
}