PT-2025-47819 · Unknown+1 · Xchacha20-Poly1305+1

Luigino Camastra · CVE-2025-11931 · Published 2025-11-21 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-11931

Description An integer underflow can lead to out-of-bounds access during decryption using XChaCha20-Poly1305. This occurs specifically when calling the wc XChaCha20Poly1305 Decrypt() function, which is utilized by direct application calls and not through TLS connections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2025-11931

JLSEC-2026-686

Affected Products

Debian

Xchacha20-Poly1305

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11931.json · Exploit
• https://github.com/wolfSSL/wolfssl/pull/9223 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-11931 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11931 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11931 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11931 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11931 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11931 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-686 · Vendor Advisory
• https://t.me/CVEtracker/37989 · Telegram Post
• https://twitter.com/dailycve/status/1996657839813939638 · Twitter Post
• https://t.me/msrcreports/2308 · Telegram Post
• https://twitter.com/CVEnew/status/1992008936178827680 · Twitter Post
• https://github.com/advisories/GHSA-h957-386q-gm5j · Note