Buffer Over-Read Vulnerability in liboqs Cryptographic Library by Open Quantum Safe

CVE-2026-104254

What is CVE-2026-104254?

liboqs, a C-language cryptographic library by Open Quantum Safe, presents a buffer over-read issue in specific versions (0.11.0 to 0.16.0). This vulnerability arises when builds are configured with OQS_ENABLE_SIG_STFL_LMS=ON and untrusted truncated LMS or HSS-LMS signatures are processed. The flaw allows excessive reading beyond the caller-supplied signature buffer in the functions OQS_SIG_STFL_verify and OQS_SIG_STFL_alg_lms_verify. Particularly, in 'hss_validate_signature_init()', length checks do not adequately safeguard against reading beyond the buffer limits, which may cause up to 32 bytes to be read excessively. Furthermore, in version 0.16.0, the function is_hss_public_key() may also read additional bytes due to insufficient validation. While this vulnerability does not compromise signature validity, it could potentially lead to application crashes or denial of service, rather than exposing sensitive data or accepting invalid signatures. A fix is anticipated in version 0.17.0.

References