CVE-2026-22791: openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP
Last updated 1 September 2026
Other sources
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKMECDHAESKEYWRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking CWrapKey. This can lead to heap corruption, or denial-of-service.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opencryptokito a version that resolves this vulnerability.Fixed in 3.8.1+dfsg-3.2Fixed in 3.23.0+dfsg-0.3Fixed in 3.27.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22791?
CVE-2026-22791 is classified as a critical severity vulnerability due to its potential for local exploitation leading to a heap buffer overflow.
How do I fix CVE-2026-22791?
To mitigate CVE-2026-22791, upgrade to openCryptoki version 3.27.0 or later that contains the patches for the vulnerability.
Who is affected by CVE-2026-22791?
CVE-2026-22791 affects versions 3.25.0 and 3.26.0 of the openCryptoki library for both Linux and AIX platforms.
What is the impact of CVE-2026-22791?
The impact of CVE-2026-22791 could allow an attacker with local access to execute arbitrary code via a crafted request leading to potential data compromise.
How can I determine if my system is vulnerable to CVE-2026-22791?
You can determine if your system is vulnerable to CVE-2026-22791 by checking the version of openCryptoki currently installed and ensuring it is not within the affected range.