CVE-2026-22791

Description

openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.

PUBLISHED Reserved 2026-01-09 | Published 2026-01-13 | Updated 2026-01-13 | Assigner GitHub_M

Problem types

CWE-131: Incorrect Calculation of Buffer Size

Product status

References

github.com/...yptoki/security/advisories/GHSA-26f5-3mwq-4wm7

github.com/...ommit/785d7577e1477d12fbe235554e7e7b24f2de34b7

github.com/...ommit/e37e9127deeeb7bf3c3c4d852c594256c57ec3a8

cve.org (CVE-2026-22791)

nvd.nist.gov (CVE-2026-22791)

Download JSON