CVE-2026-104267: Botan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parameters
Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only 32-bit systems are affected, and exposure requires that Scrypt is enabled and the application accepts Scrypt parameters from a hostile source. One identified example is an application that decrypts attacker-supplied encrypted private keys.
What must an attacker be able to control to trigger the overflow?
The attacker must be able to provide Scrypt parameters that reach Botan's Scrypt implementation. Crafted parameters can cause the required-memory calculation to wrap, leading to a too-small heap allocation followed by roughly four gigabytes of writes beyond that buffer.
What is the expected impact of successful exploitation?
The described triggering condition immediately crashes the process, causing denial of service. Arbitrary code execution has not been demonstrated and is considered difficult, though it cannot be excluded because the condition provides a heap overwrite primitive.
What should teams do if they cannot immediately update?
Avoid processing hostile or untrusted Scrypt parameters on affected 32-bit deployments, or otherwise ensure such parameters are not accepted by the application. The issue is fixed in Botan version 3.13.0.