liboqs, a C cryptographic library implementing post-quantum algorithms, had an out-of-bounds read vulnerability (CWE-125) in its XMSS and XMSS^MT stateful signature verification code prior to version 0.16.0. The issue arises when the verification function is called with a signature buffer sized for one algorithm but a public key whose OID references a different XMSS parameter set with a larger signature size. The code re-parses the OID and uses the larger signature size to index into the signature buffer, reading beyond its bounds. This out-of-bounds data is only consumed internally in a hash computation and is not returned or leaked, so no oracle exists for data disclosure. The primary observable effect is a possible crash of the verifying process due to invalid memory access, leading to denial of service. The vulnerability is fixed in liboqs version 0.16.0.

The vulnerability can cause the verifying process to crash if the out-of-bounds read crosses into unmapped memory, resulting in denial of service. There is no confidentiality or integrity impact as the out-of-bounds data is not exposed or leaked to an attacker. No known exploits are reported in the wild.

Upgrade liboqs to version 0.16.0 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 0.16.0, applying this official fix is the recommended remediation. No additional mitigation is required.