CVE-2026-71225 is a cryptographic vulnerability in libkcapi where one-shot symmetric cipher operations on inputs larger than 64 KiB in stateful modes (e.g., Counter (CTR) or Cipher Block Chaining (CBC)) improperly reuse the Initialization Vector (IV) for each internal data chunk. This reuse of IV compromises the confidentiality of encrypted data by revealing relationships between plaintext chunks and may also impact data integrity due to incorrect cryptographic processing. The vulnerability can be triggered remotely by supplying specially crafted large inputs to applications utilizing libkcapi. The vendor advisory recommends avoiding one-shot symmetric cipher APIs for large inputs and instead using the streaming interface or ensuring input sizes remain below the chunking threshold to maintain IV consistency.

The vulnerability leads to a significant weakening of data confidentiality because repeated IV use in stateful cipher modes can expose relationships in encrypted plaintext. It may also affect data integrity by causing incorrect cryptographic processing. The CVSS v3.1 score is 6.5 (medium severity) with high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild. The attack complexity is high, requiring network access without privileges or user interaction.

According to the Red Hat advisory, applications using libkcapi should avoid one-shot symmetric cipher APIs for inputs larger than 64 KiB when continuous-message semantics are critical. Instead, they should use the streaming interface for processing large messages or ensure one-shot inputs remain below the internal chunking threshold to guarantee consistent IV application. No official patch is currently indicated; patch status is not yet confirmed — check the vendor advisory for updates.