Memory Corruption Vulnerability in Botan C++ Cryptography Library

CVE-2026-118769

What is CVE-2026-118769?

The Botan C++ cryptography library has a vulnerability related to memory management within its C API function botan_block_cipher_block_size. Versions ranging from 2.1.0 to 3.12.0 lack adequate bounds checking when converting a size_t block size to an int. This oversight allows attackers to exploit applications that utilize the FFI raw ECB mode and accept external algorithm parameter strings. By selecting the variable-block-size Lion cipher, attackers can truncate the reported block size, resulting in insufficient memory allocation during block processing, which eventually leads to memory corruption. This issue has been addressed in version 3.13.0.

References