Signed Integer Overflow Vulnerability in NetBSD's Crypto Driver
CVE-2026-32849

5.7MEDIUM

Key Information:

Vendor

Netbsd

Status
Src
Vendor
CVE Published:
18 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-32849?

The vulnerability in NetBSD's cryptodev_op function arises from a signed integer overflow due to the improper handling of data types. The local variable iov_len, defined as a signed integer, erroneously receives a value from the unsigned variable cop->dst_len, leading to undefined behavior when dst_len exceeds INT_MAX. This flaw enables a local attacker with access to /dev/crypto to exploit this weakness, potentially resulting in a kernel panic from a NULL pointer dereference. This issue becomes particularly critical when the CONFIG_SVS setting is disabled, allowing for possible exploitation during certain conditions of a compression session.

Affected Version(s)

src 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-32849 - Proof of Concept

References

https://nasm.re/posts/uaf_netbsd_crypto/
technical-descriptionexploit
https://github.com/NetBSD/src/commit/ec8451efc1565516aba9...
patch
https://www.vulncheck.com/advisories/netbsd-signed-intege...
third-party-advisory

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

nasm
VulnCheck
.