MIK CryptX up to 0.088_000 on Perl stack-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in MIK CryptX up to 0.088_000 on Perl. The impacted element is the function gcm_decrypt_verify/ccm_decrypt_verify/chacha20poly1305_decrypt_verify. The manipulation results in stack-based overflow. This vulnerability is known as CVE-2026-41565. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in MIK CryptX up to 0.088_000 on Perl. Affected is the function gcm_decrypt_verify/ccm_decrypt_verify/chacha20poly1305_decrypt_verify. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-41565 since 04/21/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 319619 (Fedora 43 : perl-CryptX (2026-2ef4c0c642)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.088_001 eliminates this vulnerability. Applying the patch 57e69e541b0718ca8724c2f61514322a2d859bc1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (319619). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MIK

Name

• CryptX

Version

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion