CVE-2026-22791 openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP
A heap buffer overflow in openCryptoki allows local attackers to cause denial of service or potential code execution via crafted EC public keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22791?
CVE-2026-22791 is a medium-severity memory corruption vulnerability in opencryptoki, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
Weakness: CWE-131
Which versions are affected by CVE-2026-22791?
It affects 1 product.
Linux distribution packages (2)
openCryptoki SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.26.0-150700.5.9.1 |
openCryptoki openSUSE:Tumbleweed | All versions | 3.26.0-3.1 |
Products include Opencryptoki Project Opencryptoki.
How do I fix CVE-2026-22791?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-22791 being exploited?
There is no known exploitation of CVE-2026-22791 in the wild and no public exploit code.
Other vulnerabilities in opencryptoki
- CVE-2026-40253 openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c
- CVE-2026-23893 openCryptoki has improper link resolution before file access (link following)
- CVE-2012-4455 Path traversal in n/a
- CVE-2024-0914 Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)
- CVE-2021-3798 Information disclosure in opencryptoki
Sources
Also known as GHSA-26f5-3mwq-4wm7, SUSE-SU-2026:0291-1, UBUNTU-CVE-2026-22791, openSUSE-SU-2026:10048-1.