PT-2026-2795 · Unknown · Opencryptoki

Pavelkohout396 · Published 2026-01-13 · Updated 2026-02-13 · CVE-2026-22791

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions openCryptoki versions 3.25.0 and 3.26.0

Description openCryptoki is a PKCS#11 library and tools for Linux and AIX. A heap buffer overflow exists in the CKM ECDH AES KEY WRAP implementation. An attacker with local access can cause out-of-bounds writes in the host process by providing a compressed EC public key and calling C WrapKey. This can result in heap corruption or a denial-of-service condition.

Recommendations Update to a version of openCryptoki newer than 3.26.0.

Exploit

Fix

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2026-22791

GHSA-26F5-3MWQ-4WM7

OESA-2026-1257

OESA-2026-1258

OESA-2026-1320

OESA-2026-1321

OPENSUSE-SU-2026:10048-1

OPENSUSE-SU-2026:20233-1

SUSE-SU-2026:0291-1

SUSE-SU-2026:20345-1

SUSE-SU-2026:20434-1

Affected Products

Opencryptoki

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22791.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-22791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22791 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20345-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23893 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0291-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20434-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10048-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1257 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20233-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22791 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1321 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1320 · Vendor Advisory