CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Attackers can trigger buffer overflows in the Python cryptography library by passing non-contiguous buffers to APIs, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39892?
CVE-2026-39892 is a medium-severity memory corruption vulnerability in pyca cryptography, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Which versions are affected by CVE-2026-39892?
3 open source packages ship an affected version, including cryptography. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cryptography PyPI | From 45.0.0 | 46.0.7 |
cryptography PyPI | From 45.0.0 | 46.0.7 |
cryptography PyPI | From 45.0.0 | 46.0.7 |
Linux distribution packages (1)
python-cryptography openSUSE:Tumbleweed | All versions | 46.0.7-1.1 |
Products include Cryptography.io Cryptography.
How do I fix CVE-2026-39892?
Upgrade cryptography to 46.0.7 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-39892 being exploited?
There is no known exploitation of CVE-2026-39892 in the wild and no public exploit code.
Other vulnerabilities in pyca cryptography
- CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
- CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
- CVE-2024-26130 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
- CVE-2023-38325 cryptography mishandles SSH certificates
- CVE-2023-49083 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Sources
Also known as ALPINE-CVE-2026-39892, BELL-CVE-2026-39892, CLEANSTART-2026-HA56208, CLEANSTART-2026-TY96751, CLSA-2026-1778028237, DEBIAN-CVE-2026-39892 and 18 more.