CVE-2026-16458: Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto
Published Aug 13, 2026
·Updated
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.
Affected Software
1 affected component
Oberon microsystem AG ocrypto>=3.0.0<4.0.1
Event History
Aug 13, 2026
CVE Published
via MITRE·08:31 AM
Data Sourced
via MITRE·08:31 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-16458?
CVE-2026-16458 has a risk rating of 59, indicating a moderate severity level.
2
How do I fix CVE-2026-16458?
To fix CVE-2026-16458, upgrade the ocrypto library to version 4.0.1 or later.
3
Which software is affected by CVE-2026-16458?
CVE-2026-16458 affects all versions of the ocrypto library from 3.0.0 up to, but not including, 4.0.1.
4
What type of attack is associated with CVE-2026-16458?
CVE-2026-16458 is associated with a timing side-channel attack that exploits RSA PKCS#1 v1.5 decryption.
5
What can attackers gain from exploiting CVE-2026-16458?
By exploiting CVE-2026-16458, attackers can recover plaintext data through timing measurements.