{"id":"CVE-2026-22791","summary":"openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP","details":"openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.","aliases":["GHSA-26f5-3mwq-4wm7"],"modified":"2026-08-12T15:31:40.258709Z","published":"2026-01-13T19:06:41.052Z","related":["SUSE-SU-2026:0291-1","SUSE-SU-2026:20345-1","SUSE-SU-2026:20434-1","SUSE-SU-2026:22293-1","SUSE-SU-2026:22365-1","openSUSE-SU-2026:10048-1","openSUSE-SU-2026:20233-1","openSUSE-SU-2026:21059-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-131"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22791.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22791.json"},{"type":"ADVISORY","url":"https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-26f5-3mwq-4wm7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22791"},{"type":"FIX","url":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7"},{"type":"FIX","url":"https://github.com/opencryptoki/opencryptoki/commit/e37e9127deeeb7bf3c3c4d852c594256c57ec3a8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opencryptoki/opencryptoki","events":[{"introduced":"c20ccf12bab4877088a2b8b01a3168bfe407218b"},{"fixed":"785d7577e1477d12fbe235554e7e7b24f2de34b7"},{"fixed":"e37e9127deeeb7bf3c3c4d852c594256c57ec3a8"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:opencryptoki_project:opencryptoki:3.25.0:*:*:*:*:*:*:*","cpe:2.3:a:opencryptoki_project:opencryptoki:3.26.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.25.0"},{"last_affected":"3.25.0"},{"introduced":"3.26.0"},{"last_affected":"3.26.0"}]}}],"versions":["3.25.0","3.26.0","v3.26.0","v3.25.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:31:40Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/decr_mgr.c"},"deprecated":false,"digest":{"line_hashes":["95229240065523874681931989203713637207","53029481316736056402751237409419436663","78338001345001644498965443275507680108","142748932277025867171247047253881081628","172950411028489176578462088655475242118","23613893133483013860102402129417346171","49804443245956864770303597728134074280","145309896647156561065214679572135930601"],"threshold":0.9},"id":"CVE-2026-22791-051d4efe"},{"source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/mech_ec.c"},"deprecated":false,"digest":{"line_hashes":["105873518108037796855594189896008458651","181929037590455681180964423601447703906","186016950990741947620561391862836214445","337687025157363192483816338278656615200","308351838024520592887503970854527415587"],"threshold":0.9},"id":"CVE-2026-22791-0ed533d2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"291016418553550259201689477055993250439","length":16165},"id":"CVE-2026-22791-259e9ecd","signature_type":"Function","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/encr_mgr.c","function":"encr_mgr_init"}},{"id":"CVE-2026-22791-650d2d80","signature_type":"Line","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/key_mgr.c"},"deprecated":false,"digest":{"line_hashes":["121210315150102089442085322924029245542","94437348224244628930917420686756801280","59315021747767969414960644541107373668","84127406193882510224201849699199883290","121210315150102089442085322924029245542","100411142269610238315181850995902140834","252959844347166804923739008754868279378","324649182655099819681452604766633557395","121210315150102089442085322924029245542","335983947619009579987425096413698630703","102491224351655792768863392304514674199","95160076612476748171197332072607349377"],"threshold":0.9}},{"target":{"file":"usr/lib/common/decr_mgr.c","function":"decr_mgr_init"},"deprecated":false,"digest":{"function_hash":"28867156110222275580633148020267398319","length":16392},"id":"CVE-2026-22791-aca0d2ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7"},{"signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/encr_mgr.c","function":"encr_mgr_encrypt"},"deprecated":false,"digest":{"length":4185,"function_hash":"69585498452481998302442114925377533041"},"id":"CVE-2026-22791-ad5ac8ea","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["95229240065523874681931989203713637207","53029481316736056402751237409419436663","16849080295849871608337778495106334800","72612305881741375368807289633906418811","10021952637885360870786612704758334782","72933985784812766161759306996592602047","148668204405359086355099004693471156500","47258003238487818894300156718050550646"],"threshold":0.9},"id":"CVE-2026-22791-be6895dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/encr_mgr.c"}},{"source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/decr_mgr.c","function":"decr_mgr_decrypt"},"deprecated":false,"digest":{"function_hash":"103040654334632848248106334539983806110","length":4319},"id":"CVE-2026-22791-c5fe97fb","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/key_mgr.c","function":"key_mgr_unwrap_key"},"deprecated":false,"digest":{"length":7222,"function_hash":"41180471097345308450217383836619122338"},"id":"CVE-2026-22791-f6d8a283","signature_type":"Function"},{"digest":{"function_hash":"17855084193324097996503031446759336440","length":9042},"id":"CVE-2026-22791-fd743cc4","signature_type":"Function","signature_version":"v1","source":"https://github.com/opencryptoki/opencryptoki/commit/785d7577e1477d12fbe235554e7e7b24f2de34b7","target":{"file":"usr/lib/common/key_mgr.c","function":"key_mgr_wrap_key"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22791.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"}]}