CVE-2026-40253
published 2026-04-16CVE-2026-40253: openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common…
PriorityP426medium6.1CVSS 3.1
AVLACLPRNUIRSUCLINAH
EPSS
0.16%
5.2th percentile
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opencryptoki | opencryptoki | <= 3.26.0 | — |
| opencryptoki_project | opencryptoki | <= 3.26.0 | — |
| opencryptoki_project | opencryptoki | — | — |
| ubuntu | opencryptoki | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vendor_redhat6.8MEDIUM
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
openCryptoki vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 6.1
CVE-2026-23893 [MEDIUM] openCryptoki vulnerabilities
Title: openCryptoki vulnerabilities
Summary: Several security issues were fixed in openCryptoki.
It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)
It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could possibly use this issue to achieve
privilege escalation or access sensitive information. (CVE-2026-23893)
It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap
buffer overflow vulnerability. An attacker could possibly use this issue to
trigger heap corruption, or denial-of-service. (CVE-2026-22791)
Instructions: In general, a standard system update will make al
Ubuntu
openCryptoki vulnerabilities
vendor_ubuntu·2026-08-27·CVSS 6.8
CVE-2026-23893 [MEDIUM] openCryptoki vulnerabilities
Title: openCryptoki vulnerabilities
Summary: Several security issues were fixed in openCryptoki.
It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)
It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could possibly use this issue to achieve
privilege escalation or access sensitive information. (CVE-2026-23893)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
vendor_redhat·2026-04-16·CVSS 6.8
CVE-2026-40253 [MEDIUM] CWE-125 openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects
A flaw was found in openCryptoki, a PKCS#11 (Cryptographic Token Interface Standard) library. The BER/DER (Basic Encoding Rules/Distinguished Encoding Rules) decoding functions in the shared common library do not properly validate attacker-controlled length fields against actual buffer boundaries. This allows an attacker to supply a malformed BER-encoded cryptographic object, potentially through PKCS#11 operations, token loading, or remote backend communication. This can lead to out-of-bounds reads and integer underflows, resulting in information disclosure and a denial of service.
Package: libica (Red Hat Enterprise Linux 10) - Not affected
Package: opencryptoki (Red
VulDB
openCryptoki up to 3.26.0 on Linux/AIX asn1.c length out-of-bounds (GHSA-c9cf-6vr4-wfxm / CNNVD-202604-3433)
vuldb·2026-04-17·CVSS 6.8
CVE-2026-40253 [MEDIUM] openCryptoki up to 3.26.0 on Linux/AIX asn1.c length out-of-bounds (GHSA-c9cf-6vr4-wfxm / CNNVD-202604-3433)
A vulnerability, which was classified as problematic, was found in openCryptoki up to 3.26.0 on Linux/AIX. The affected element is the function ber_decode_INTEGER/ber_decode_SEQUENCE/ber_decode_OCTET_STRING/ber_decode_BIT_STRING/ber_decode_CHOICE of the file asn1.c. Such manipulation of the argument length leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-40253. The attack must be carried out locally. There is no available exploit.
Applying a patch is advised to resolve this issue.
No detection rules found.
No public exploits indexed.
2026-04-16
Published