CVE-2026-16458 describes a padding oracle attack vulnerability in the ocrypto library by Oberon microsystems AG. The vulnerability affects version 3.0.0 and involves observable timing discrepancies during RSA PKCS#1 v1.5 decryption operations. An attacker can exploit these timing differences to recover plaintext data. The vulnerability is linked to CWE-208 and CWE-327, indicating issues with timing side channels and cryptographic algorithm weaknesses. There is no vendor advisory or patch information provided, and no known exploits are reported in the wild.

An attacker with local access could exploit timing discrepancies in RSA PKCS#1 v1.5 decryption to recover plaintext information, potentially compromising the confidentiality of encrypted data. The CVSS 4.0 score is 5.9 (medium severity), reflecting the requirement for local access and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding the use of affected versions or mitigating exposure by limiting access to the vulnerable cryptographic operations.