CVE-2026-40253
published 2026-04-16CVE-2026-40253: openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common…
PriorityP426medium6.1CVSS 3.1
AVLACLPRNUIRSUCLINAH
EPSS
0.16%
5.7th percentile
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opencryptoki | opencryptoki | <= 3.26.0 | — |
| opencryptoki_project | opencryptoki | <= 3.26.0 | — |
| opencryptoki_project | opencryptoki | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
openCryptoki up to 3.26.0 on Linux/AIX asn1.c length out-of-bounds (GHSA-c9cf-6vr4-wfxm / CNNVD-202604-3433)
vuldb·2026-04-17·CVSS 6.8
CVE-2026-40253 [MEDIUM] openCryptoki up to 3.26.0 on Linux/AIX asn1.c length out-of-bounds (GHSA-c9cf-6vr4-wfxm / CNNVD-202604-3433)
A vulnerability, which was classified as problematic, was found in openCryptoki up to 3.26.0 on Linux/AIX. The affected element is the function ber_decode_INTEGER/ber_decode_SEQUENCE/ber_decode_OCTET_STRING/ber_decode_BIT_STRING/ber_decode_CHOICE of the file asn1.c. Such manipulation of the argument length leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-40253. The attack must be carried out locally. There is no available exploit.
Applying a patch is advised to resolve this issue.
Red Hat
openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
vendor_redhat·2026-04-16·CVSS 6.8
CVE-2026-40253 [MEDIUM] CWE-125 openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
A flaw was found in openCryptoki, a PKCS#11 (Cryptographic Token Interface Standard) library. The BER/DER (Basic Encoding Rules/Distinguished Encoding Rules) decoding functions in the shared common library do not properly validate attacker-controlled length fields against actual buffer boundaries. This allows an attacker to supply a malformed BER-encoded cryptographic object, potentially through PKCS#11 operations, token loading, or remote backend communication. This can lead to out-of-bounds reads and integer underflows, resulting in information disclosure and a denial of service.
Package: libica (Red Hat Enterprise Linux 10) - Not affected
Package: opencryptoki (Red
No detection rules found.
No public exploits indexed.
2026-04-16
Published