Incorrect Calculation of Buffer Size in Opencryptoki - CVE-2026-22791

Vulnerability identifier: #VU121274

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-22791

CWE-ID: CWE-131

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error within the CKM_ECDH_AES_KEY_WRAP implementation in ecdh_aes_key_wrap() function in usr/lib/common/mech_ec.c. A remote attacker can pass a specially crafted public EC key to the application and perform a denial of service attack. 

Opencryptoki
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Server Applications Module
openEuler
Ubuntu
opencryptoki (Ubuntu package)
opencryptoki
opencryptoki-help
opencryptoki-devel
opencryptoki-debugsource
opencryptoki-debuginfo
openCryptoki-devel
openCryptoki-debuginfo
openCryptoki-debugsource
openCryptoki-64bit-debuginfo
openCryptoki
openCryptoki-64bit

Install updates from vendor's website.

opencryptoki (Ubuntu package) - update to 3.26.0+dfsg-0ubuntu1.1
opencryptoki - update to 3.26.0-1
opencryptoki-help - update to 3.26.0-1
opencryptoki-devel - update to 3.26.0-1
opencryptoki-debugsource - update to 3.26.0-1
opencryptoki-debuginfo - update to 3.26.0-1
openCryptoki-devel - update to 3.26.0-150700.5.9.1
openCryptoki-debuginfo - update to 3.26.0-150700.5.9.1
openCryptoki-debugsource - update to 3.26.0-150700.5.9.1
openCryptoki-64bit-debuginfo - update to 3.26.0-150700.5.9.1
openCryptoki - update to 3.26.0-150700.5.9.1
openCryptoki-64bit - update to 3.26.0-150700.5.9.1

• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-26f5-3mwq-4wm7
• https://github.com/opencryptoki/opencryptoki/commit/e37e9127deeeb7bf3c3c4d852c594256c57ec3a8

• Buffer overflow in Opencryptoki
• SUSE update for openCryptoki
• openEuler 24.03 LTS SP3 update for opencryptoki
• openEuler 24.03 LTS SP1 update for opencryptoki
• openEuler 24.03 LTS SP2 update for opencryptoki
• openEuler 24.03 LTS update for opencryptoki
• openEuler 22.03 LTS SP4 update for opencryptoki
• Ubuntu update for opencryptoki