Incorrect Calculation of Buffer Size in Opencryptoki - CVE-2026-22791

Vulnerability identifier: #VU121274

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-22791

CWE-ID: CWE-131

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error within the CKM_ECDH_AES_KEY_WRAP implementation in ecdh_aes_key_wrap() function in usr/lib/common/mech_ec.c. A remote attacker can pass a specially crafted public EC key to the application and perform a denial of service attack. 

Opencryptoki
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Server Applications Module
openEuler
opencryptoki-help
opencryptoki-devel
opencryptoki-debugsource
opencryptoki-debuginfo
opencryptoki
openCryptoki-devel
openCryptoki-debuginfo
openCryptoki-debugsource
openCryptoki-64bit-debuginfo
openCryptoki
openCryptoki-64bit

Install updates from vendor's website.

opencryptoki-help - update to 3.26.0-1
opencryptoki-devel - update to 3.26.0-1
opencryptoki-debugsource - update to 3.26.0-1
opencryptoki-debuginfo - update to 3.26.0-1
opencryptoki - update to 3.26.0-1
openCryptoki-devel - update to 3.26.0-150700.5.9.1
openCryptoki-debuginfo - update to 3.26.0-150700.5.9.1
openCryptoki-debugsource - update to 3.26.0-150700.5.9.1
openCryptoki-64bit-debuginfo - update to 3.26.0-150700.5.9.1
openCryptoki - update to 3.26.0-150700.5.9.1
openCryptoki-64bit - update to 3.26.0-150700.5.9.1

• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-26f5-3mwq-4wm7
• https://github.com/opencryptoki/opencryptoki/commit/e37e9127deeeb7bf3c3c4d852c594256c57ec3a8

• Buffer overflow in Opencryptoki
• SUSE update for openCryptoki
• openEuler 24.03 LTS SP3 update for opencryptoki
• openEuler 24.03 LTS SP1 update for opencryptoki
• openEuler 24.03 LTS SP2 update for opencryptoki
• openEuler 24.03 LTS update for opencryptoki
• openEuler 22.03 LTS SP4 update for opencryptoki