The CROSS implementation of the CROSS post-quantum signature algorithm contained a stack-based buffer overflow vulnerability (CWE-121) caused by an integer underflow of the mlen parameter in the crypto_sign_open() function. This underflow leads to improper buffer size calculations, enabling a buffer overflow condition. The vulnerability affects all versions prior to the commit fc6b7e7, which introduced a patch to fix this issue. The CVSS 4.0 score is 6.9, indicating a medium severity vulnerability exploitable remotely without privileges or user interaction. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could lead to a stack-based buffer overflow, potentially allowing an attacker to cause a denial of service or execute arbitrary code within the context of the vulnerable application. The vulnerability is remotely exploitable without authentication or user interaction. However, no known active exploitation has been reported.

This vulnerability has been patched in the CROSS implementation as of commit fc6b7e7. Users and maintainers should update to versions including or later than this commit to remediate the issue. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the vendor commit reference. No additional mitigation steps are indicated by the vendor advisory.