C-language Cryptographic Library Vulnerability in Open Quantum Safe

CVE-2026-47738

What is CVE-2026-47738?

The Open Quantum Safe's liboqs cryptographic library contains a vulnerability in its implementation of certain NTRU KEMs. Specifically, the OQS_KEM_encaps_derand function can dereference an uninitialized function pointer, causing potential crashes and denial of service for applications that instantiate the affected KEMs and invoke the function. This issue arises from the allocation of OQS_KEM objects without zero initialization and the lack of necessary pointer checks before function calls. The vulnerability impacts six specific NTRU constructors, making it crucial for users to update to version 0.16.0, where this issue has been addressed.

References