CVE-2026-44518: CWE-20: Improper Input Validation in open-quantum-safe liboqs
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a signature buffer shorter than the expected signature size for the given parameter set, the implementation does not validate the caller-supplied length and proceeds to read past the end of the buffer. The out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.
AI Analysis
Technical Summary
The liboqs cryptographic library, used for post-quantum cryptography, contains an improper input validation vulnerability (CWE-20) leading to an out-of-bounds read (CWE-125) in versions before 0.16.0. Specifically, the XMSS and XMSS^MT signature verification functions do not check that the signature buffer length matches the expected size, causing reads past the buffer end during internal hash computations. Although no sensitive data is exposed, this can cause a crash of the verifying process if the read accesses unmapped memory pages. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). The issue is fixed in liboqs version 0.16.0.
Potential Impact
The primary impact is a denial of service due to a crash of the process performing signature verification when given a malformed signature buffer shorter than expected. There is no confidentiality or integrity impact as no data is leaked or modified. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade liboqs to version 0.16.0 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify the upgrade from the official open-quantum-safe project sources. No other mitigations are indicated.
CVE-2026-44518: CWE-20: Improper Input Validation in open-quantum-safe liboqs
Description
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a signature buffer shorter than the expected signature size for the given parameter set, the implementation does not validate the caller-supplied length and proceeds to read past the end of the buffer. The out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.
CVSS v3.1
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The liboqs cryptographic library, used for post-quantum cryptography, contains an improper input validation vulnerability (CWE-20) leading to an out-of-bounds read (CWE-125) in versions before 0.16.0. Specifically, the XMSS and XMSS^MT signature verification functions do not check that the signature buffer length matches the expected size, causing reads past the buffer end during internal hash computations. Although no sensitive data is exposed, this can cause a crash of the verifying process if the read accesses unmapped memory pages. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). The issue is fixed in liboqs version 0.16.0.
Potential Impact
The primary impact is a denial of service due to a crash of the process performing signature verification when given a malformed signature buffer shorter than expected. There is no confidentiality or integrity impact as no data is leaked or modified. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade liboqs to version 0.16.0 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify the upgrade from the official open-quantum-safe project sources. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T18:28:20.888Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a19dc07e29bf47b50ff85ca
Added to database: 5/29/2026, 6:33:43 PM
Last enriched: 5/29/2026, 7:03:58 PM
Last updated: 5/31/2026, 4:54:45 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.