{"id":"CVE-2026-44518","summary":"liboqs: XMSS Buffer Overread Bug","details":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a signature buffer shorter than the expected signature size for the given parameter set, the implementation does not validate the caller-supplied length and proceeds to read past the end of the buffer. The out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.","aliases":["GHSA-wf7v-fhxj-73m2"],"modified":"2026-09-10T18:26:53.048592008Z","published":"2026-05-29T18:07:07.107Z","related":["SUSE-SU-2026:23313-1","SUSE-SU-2026:3420-1","openSUSE-SU-2026:21634-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44518.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-20"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44518.json"},{"type":"ADVISORY","url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-wf7v-fhxj-73m2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44518"},{"type":"FIX","url":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-quantum-safe/liboqs","events":[{"introduced":"0"},{"fixed":"ef70dea7c85e5637f37828d75e5b9bb29dbfe513"}],"database_specific":{"cpe":"cpe:2.3:a:openquantumsafe:liboqs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"0.15.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["0.15.0","0.15.0-rc2","0.15.0-rc1","0.14.0","0.12.0","0.12.0-rc1","0.10.0","0.9.0","0.9.0-rc1","0.8.0","0.8.0-rc1","ietf116","0.7.2","0.7.2-rc2","0.7.2-rc1","0.7.1","0.7.1-rc1","0.7.0","0.7.0-rc4","0.7.0-rc3","0.6.0","0.6.0-rc3","0.6.0-rc2","0.6.0-rc1","0.5.0","0.4.0","0.3.0","0.2.0","master-0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44518.json","vanir_signatures_modified":"2026-08-12T16:24:29Z","vanir_signatures":[{"digest":{"length":5168,"function_hash":"566251205338277947681585760693685422"},"id":"CVE-2026-44518-09179cad","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"tests/test_sig_stfl.c","function":"sig_stfl_test_correctness"},"deprecated":false},{"id":"CVE-2026-44518-25015db6","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"tests/test_sig_stfl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["235080752770317485701889317655849250815","143741461092383164682191006664970173231","182554116872732261265893285911662470013","191498729814548171026498447020539371433","24360437707770469737056713569295199941","12434549499744012410825638099653649464","158182406996090713347076966137739381852","176261712642832739149365220334261611670","60263795667813263029335713197267413289","103071584023724019516318349659111999308","337170073207097503963662452625019664307","79996671262896037847307050172445445921","326972899196035460980690299209410883292","185237935319050287770968683882817420693","339157981175753782014920143821558129294","7646309558479156826252469753602162567","155032176382875810763763519839095984266","281055849771010397669826493082569014394","159130940307342196955521656134041282151","59929876720859251375263305644136646845","89938587715169599657191008460260915236","337779449953467028747361513175386208853","313298288570331153213614305797694390026","323093200035495147376983061893005088546","182947231047010150550963316018122928629","266072211263895538407812267598992387748","85123445060802560913911187434985217599","320829343809279591505026387713406681263","7673463244230914542493714616777694886","178728536710860266857665789192362264050","93005818013140288167728196124491741038","297219649833787948908578714653141291527","295714177625238435778875989409454775638","209402698310771585787219609327052145671","104517244185778297977378597485054888261","31191588969559551851527236353735126603","97543235313892459834660838345498578039","1092053120456926191119695321766332219","109518680900093146230499521018937537699","161210905006852767012882736948691597697","25939915939969484547867200709875093400","330725426177793556280283739440309410799","170531562035892253675175873208803157123","37992871825252454678037911381766177868","289908060236865097670150575057628262751","9149574840448000263606957361064065698","237984338602777983727993952655916630625","293957387499007649975216372527403640826","4628311319581600020495802787504513270","47475435430355360034106138786347336778","218484768988328583825087327967237701221","48405186066861197131242041869418336092","184494964184581364748768468116639458806","197654884494765484684346514566705896982","166213696685546353679322570392401794649","315077450015625634779290512392070648592","21142199892727968888624376186823532204","259156598775562925082028736553455731251","240693184580676412445360447957959374191","294186790019710382215094864891613372867","257445450271227447571019994366312992186","251256376294908152627302397032207792966","62256765526589992699678286990449034585","91021296422855342428691866153744795797","106046368286798763518810348378417095784","130467155133115705083247378923382735775","138471923812291528520343307443640884859","171326672713970385102466088790416617603","208067795854573007346904776704443631352","149424565878405892010165947627890207188","1951372805779320315085130882568386384","1844222053796842503878395065953227723","266005114936810161691439860690362120241","286288206684132068173897236134305330233","109084290557123391861374497092044624271","18390302082657130998974558305221994672","192305914957886919899147328000088855016","333469015974499565438704805713880325001","37093829665342178803455774354611673646","186004654253327772741073405933332762684","122247015637445907263692995329022903774","23137886608080891134750350807352056782","116493685045392232222398883866888893101","198828714276310182361311965140505692049","199847534936672181249272518330611496350","125033348977441939738959611892704842011","226779719236563817143866518552312251931"]}},{"deprecated":false,"digest":{"function_hash":"260633090544819168417923477288378681805","length":170},"id":"CVE-2026-44518-36d80dfc","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c","function":"_verify"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"tests/test_sig_stfl.c","function":"main"},"deprecated":false,"digest":{"length":5164,"function_hash":"330332053578633846516478729808174293768"},"id":"CVE-2026-44518-7eed49c6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["152271552861479247343917667357988932418","320326659670111271596423338333990876559","238317383983068816104489159476223052274","291953990545798716176801059562611207286"]},"id":"CVE-2026-44518-adeba380"},{"signature_version":"v1","source":"https://github.com/open-quantum-safe/liboqs/commit/ef70dea7c85e5637f37828d75e5b9bb29dbfe513","target":{"file":"tests/test_sig_stfl.c","function":"test_correctness_wrapper"},"deprecated":false,"digest":{"function_hash":"47659602462878031209475474607091502119","length":189},"id":"CVE-2026-44518-c7f958ec","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}