Heap Buffer Overflow Vulnerability in SymCrypt by Microsoft

CVE-2026-35199

What is CVE-2026-35199?

A heap buffer overflow vulnerability exists in Microsoft SymCrypt versions 103.5.0 through 103.10.9. The issue arises when the SymCryptXmssSign function passes a 64-bit leaf count to a helper function that accepts a 32-bit value. This truncation results in a critical misallocation of memory, specifically a drastically undersized scratch buffer, during the XMSS^MT signature computation. Though exploiting this vulnerability is challenging, it requires an application that permits attacker-controlled parameters for signing—situations that are generally rare because signing operations are closely tied to trusted private key management. For optimal security, XMSS^MT signing must be conducted within a Hardware Security Module (HSM). The vulnerability has been addressed in SymCrypt version 103.11.0.

References