CVE-2025-32989

What it actually does

Heap-buffer-overread in GnuTLS during X.509 certificate parsing of the SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that exposes adjacent memory contents when the extension is malformed.

Why it matters to the business

Systems using the affected package may leak confidential memory data during routine certificate verification from remote sites, increasing risk of information disclosure in high-volume TLS environments.

How an attack unfolds

An attacker creates a certificate containing a deliberately malformed SCT extension and presents it during a TLS handshake; vulnerable GnuTLS parsing code performs an out-of-bounds read that returns sensitive process memory to the attacker.

How to fix it

Upgrade @account-kit/smart-contracts to version 4.52.0 or later; rebuild and redeploy all dependent services; verify the new package resolves the GnuTLS parsing path.

How to confirm the fix worked

Confirm installed package version is at least 4.52.0; run regression tests that submit both valid and malformed SCT certificates to exercise the fixed parsing code.

Typical attack path

1. Generate X.509 certificate embedding a crafted SCT extension
2. Host the certificate on a controlled server or MITM position
3. Force the target application to perform certificate verification
4. Trigger the overread path in GnuTLS SCT handling
5. Capture leaked memory contents containing sensitive data

How to detect it

Review TLS handshake and certificate parsing logs for entries involving SCT extension processing; correlate with memory access anomalies or unexpected data in application error streams; no specific actor-linked patterns are known.

What your security team should do

• Immediately upgrade @account-kit/smart-contracts to 4.52.0 across all environments
• Prioritize scanning and updating any services that perform outbound TLS certificate validation
• Add package version checks to CI/CD pipelines to prevent regression
• Monitor upstream GnuTLS advisories for related fixes