CVE-2026-40253 openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c
Attackers can trigger out-of-bounds reads in openCryptoki via malformed BER-encoded objects, potentially causing crashes or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40253?
CVE-2026-40253 is a medium-severity memory corruption vulnerability in opencryptoki, published on 16 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Weakness: CWE-125
Which versions are affected by CVE-2026-40253?
It affects 1 product.
Linux distribution packages (40)
opencryptoki AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-ccatok AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-devel AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-ep11tok AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-icatok AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-icsftok AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-libs AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki-swtok AlmaLinux:10 | All versions | 3.26.0-3.el10_2.1 |
opencryptoki AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-ccatok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-devel AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-ep11tok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-icatok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-icsftok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-libs AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-swtok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki-tpmtok AlmaLinux:8 | All versions | 3.22.0-3.el8_10.3 |
opencryptoki AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-ccatok AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-devel AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-ep11tok AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-icatok AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-icsftok AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-libs AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki-swtok AlmaLinux:9 | All versions | 3.26.0-2.el9_8.2 |
opencryptoki Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-ccatok Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-ccatok-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-devel Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-ep11tok Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-ep11tok-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-icatok Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-icatok-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-icsftok Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-icsftok-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-libs Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-libs-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
opencryptoki-swtok Red Hat:enterprise_linux:10.2 | All versions | 0:3.26.0-3.el10_2.1 |
Products include Opencryptoki Project Opencryptoki.
How do I fix CVE-2026-40253?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40253 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40253 exists.
Other vulnerabilities in opencryptoki
- CVE-2026-23893 openCryptoki has improper link resolution before file access (link following)
- CVE-2026-22791 openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP
- CVE-2012-4455 Path traversal in n/a
- CVE-2024-0914 Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)
- CVE-2021-3798 Information disclosure in opencryptoki
Sources
Also known as ALSA-2026:26352, ALSA-2026:28231, ALSA-2026:28256, AZL-82982, CLSA-2026-1788955910, CLSA-2026-1790079559 and 28 more.