{"id":"AZL-97884","summary":"CVE-2026-75803 affecting package edk2 20240524git3e722403cd16-18","details":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.","modified":"2026-08-28T17:48:15.693359265Z","published":"2026-08-25T13:19:29Z","upstream":["CVE-2026-75803"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803"}],"affected":[{"package":{"name":"edk2","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/edk2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240524git3e722403cd16-18"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97884.json"}}],"schema_version":"1.9.0"}