CVE-2026-32877 in botan
要約 (英語)
Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison. An invalid ciphertext can cause a heap over-read of up to 31 bytes, resulting in a crash or potentially other undefined behavior. This issue has been patched in version 3.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
責任者
GitHub_M
予約する
2026年03月16日
公開
2026年03月31日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 354283 | randombit botan 情報漏えい | 125 | 未定義 | 公式な修正 | CVE-2026-32877 |