open-quantum-safe liboqs up to 0.15.x KEM src/kem/kem.c OQS_KEM_encaps_derand uninitialized variable

Summaryinfo

A vulnerability categorized as problematic has been discovered in open-quantum-safe liboqs up to 0.15.x. This vulnerability affects the function OQS_KEM_encaps_derand of the file src/kem/kem.c of the component KEM. Executing a manipulation can lead to uninitialized variable. This vulnerability is registered as CVE-2026-47738. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in open-quantum-safe liboqs up to 0.15.x. It has been declared as problematic. This vulnerability affects the function OQS_KEM_encaps_derand of the file src/kem/kem.c of the component KEM. The manipulation with an unknown input leads to a uninitialized variable vulnerability. The CWE definition for the vulnerability is CWE-457. The code uses a variable that has not been initialized, leading to unpredictable or unintended results. As an impact it is known to affect availability. CVE summarizes:

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQS_KEM_encaps_derand can dereference an uninitialized encaps_derand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, or NTRU-HRSS-1373. The affected NTRU constructors omit the OQS_KEM.encaps_derand member because those schemes do not support derandomized encapsulation, OQS_KEM objects are allocated without zero initialization, and the wrapper in src/kem/kem.c checks only that the OQS_KEM pointer is non-null before calling through the residual heap value. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it. The supported impact is a calling-process crash and denial of service. This issue is fixed in version 0.16.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-47738 since 05/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.16.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• open-quantum-safe

Name

• liboqs

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15

Website

• Product: https://github.com/open-quantum-safe/liboqs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion