PT-2026-33373 · Unknown · Opencryptoki
Published
2026-04-16
·
Updated
2026-05-03
·
CVE-2026-40253
CVSS v3.1
6.8
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
openCryptoki versions prior to 3.26.1
Description
The BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer without a buffer length parameter and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. This issue affects all primitive decoders, including
ber decode INTEGER(), ber decode SEQUENCE(), ber decode OCTET STRING(), ber decode BIT STRING(), and ber decode CHOICE(). Specifically, ber decode INTEGER() can produce integer underflows when the encoded length is zero. An attacker can trigger out-of-bounds reads by supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as 'C CreateObject' or 'C UnwrapKey', token loading from disk, or remote backend communication. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) because the issue resides in the shared common library.Recommendations
Update to a version that includes commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opencryptoki