CVE-2026-34610 leancrypto: Integer truncation in X.509 name parser enables certificate identity impersonation
An integer truncation in the X.509 name parser allows attackers to craft certificates that impersonate victims, bypassing identity verification in PKCS#7 and code signing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34610?
CVE-2026-34610 is a medium-severity vulnerability in smuellerDD leancrypto, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.
Weakness: CWE-681
Which versions are affected by CVE-2026-34610?
It affects 1 product.
Linux distribution packages (1)
leancrypto openSUSE:Tumbleweed | All versions | 1.7.2-1.1 |
Products include Leancrypto Leancrypto.
How do I fix CVE-2026-34610?
Upgrade to a fixed version.
Is CVE-2026-34610 being exploited?
There is no known exploitation of CVE-2026-34610 in the wild and no public exploit code.
Sources
Also known as GHSA-636g-jxv4-v4gr, SUSE-SU-2026:21754-1, SUSE-SU-2026:21824-1, openSUSE-SU-2026:10563-1, openSUSE-SU-2026:20783-1.