MIK CryptX up to 0.088_000 on Perl memcmp day timing discrepancy

Summaryinfo

A vulnerability was found in MIK CryptX up to 0.088_000 on Perl. It has been classified as problematic. This affects the function memcmp. This manipulation of the argument day causes timing discrepancy. This vulnerability is handled as CVE-2026-13758. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in MIK CryptX up to 0.088_000 on Perl and classified as problematic. Affected by this vulnerability is the function memcmp. The manipulation of the argument tag with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality. The summary by CVE is:

CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on the first differing byte, so its run time depends on the number of matching leading bytes. This affects all five AEAD modes: GCM, CCM, ChaCha20Poly1305, EAX and OCB. The one-shot *_decrypt_verify helpers are unaffected; they verify the tag inside libtomcrypt with a constant-time comparison. The timing difference is a tag-verification oracle. An attacker who can submit many candidate tags for the same nonce, ciphertext and associated data while measuring the timing precisely enough may recover the expected tag byte by byte and forge a message that verifies.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-13758 since 06/29/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 0.088_001 eliminates this vulnerability. Applying the patch 7e56347d420aaf43b2ee1586f4a230492ccf1642 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40229). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• MIK

Name

• CryptX

Version

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion