CVE-2026-2100

The record

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Affected packages

Related vulnerabilities

• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-824
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-824
• CVE-2026-88054 Tesseract is an open source OCR engine. CWE-824
• CVE-2026-54920 OpenEXR is the reference implementation and specification for the EXR image format… CWE-824
• CVE-2026-47908 Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized… CWE-824
• CVE-2026-47320 Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open… CWE-824
• CVE-2026-42959 NLnet Labs Unbound up to and including version 1.25.0 has a denial of service… CWE-824
• CVE-2026-45736 ws is an open source WebSocket client and server for Node.js. CWE-824