CVE-2026-22791
MEDIUMopenCryptoki 3.25.0-3.26.0 - Heap Buffer Overflow in CKM_ECDH_AES_KEY_WRAP via Compressed EC Public Key
Title source: llmDescription
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
References (3)
Core 3
Core References
Exploit, Patch, Vendor Advisory x_refsource_confirm
https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-26f5-3mwq-4wm7
Patch x_refsource_misc
https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7
Scores
CVSS v3
6.6
EPSS
0.0024
EPSS Percentile
14.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-131
Status
published
Products (2)
opencryptoki_project/opencryptoki
3.25.0
opencryptoki_project/opencryptoki
3.26.0
Published
Jan 13, 2026
Tracked Since
Feb 18, 2026