Out-of-Bounds Read Vulnerability in openCryptoki PKCS#11 Library for Linux and AIX

CVE-2026-40253

What is CVE-2026-40253?

The openCryptoki library, essential for PKCS#11 operations, suffers from a vulnerability in its BER/DER decoding functions. This issue arises from the lack of proper buffer length validation, allowing an attacker to exploit malformed BER-encoded cryptographic objects. By manipulating the decoding process through operations such as C_CreateObject or C_UnwrapKey, an attacker can trigger out-of-bounds reads, impacting all token backends, including Soft, ICA, CCA, TPM, EP11, and ICSF. A timely patch addressing this vulnerability is available, enhancing the security of the affected library.

References