PT-2026-33373 · Opencryptoki · Opencryptoki

Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-40253

NVD

CVSS v3.1

6.8

Medium

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber decode INTEGER, ber decode SEQUENCE, ber decode OCTET STRING, ber decode BIT STRING, and ber decode CHOICE. Additionally, ber decode INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C CreateObject or C UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-40253

Affected Products

Opencryptoki

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40253 · Security Note
• https://github.com/opencryptoki/opencryptoki/commit/ed378f463ef73364c89feb0fc923f4dc867332a3 · Note
• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-c9cf-6vr4-wfxm · Note