CVE-2026-22791
Medium · 6.6CVSS
6.6
EPSS
0.3%
Published
Jan 13, 2026
CISA due date
—
The record
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | openCryptoki | 0 | 3.26.0-160000.1.1 |
| openSUSE:Leap 16.0 | openCryptoki | 0 | 3.27.0-160000.1.1 |
| openSUSE:Tumbleweed | openCryptoki | 0 | 3.26.0-3.1 |
Related vulnerabilities
- CVE-2026-40253 openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Also affects openCryptoki
- CVE-2026-23893 openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Also affects openCryptoki
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-131
- CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a… CWE-131
- CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. CWE-131
- CVE-2026-22590 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard… CWE-131
- CVE-2026-78221 An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN… CWE-131
- CVE-2026-18743 A flaw was found in popt. CWE-131