CVE-2026-126792: Heap overflow via oversized RSA signature in GCP KMS signing callback
A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies when the library is embedded in an application that supplies its own cryptographic callback implementation for key-management operations. Exploitation also requires control over that embedding application's in-process key-management provider configuration.
What level of access does an attacker need?
An attacker needs a high-privilege position that allows them to control the in-process key-management provider configuration. The attack is local and does not require user interaction.
What is the observed impact of successful exploitation?
The demonstrated impact is heap memory corruption that causes the client process to terminate abnormally. The supplied severity vector indicates integrity and availability impact, with no confidentiality impact stated.