Out-of-Bounds Read Vulnerability in liboqs Cryptographic Library

CVE-2026-46344

What is CVE-2026-46344?

In the liboqs cryptographic library, an out-of-bounds read occurs in the XMSS and XMSS^MT stateful signature verification code prior to version 0.16.0. When a verification function is invoked with a correctly sized signature buffer but a mismatched public key referencing a different XMSS parameter, the implementation attempts to process the larger signature size, potentially leading to a crash of the verifying process due to accessing unmapped memory. This flaw, while not exposing data to attackers, can cause a denial of service by interrupting operation. The issue has been addressed in version 0.16.0.

References