CVE-2026-71225 is a cryptographic vulnerability in libkcapi version 0.10.1 where one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC) improperly reuse the Initialization Vector (IV) for each internal data chunk. This reuse can significantly weaken confidentiality by revealing relationships in the encrypted data and may also cause incorrect cryptographic processing affecting integrity. The flaw arises because the library resets cipher state across chunk boundaries, leading to repeated IV usage. The vulnerability is exploitable remotely if an attacker can cause an application using libkcapi to process crafted large inputs. The CVSS 3.1 base score is 6.5 with high confidentiality impact and low integrity impact, requiring no privileges and no user interaction but high attack complexity.

The vulnerability allows an attacker to weaken the confidentiality of encrypted data by exploiting repeated IV reuse in large one-shot symmetric cipher operations, potentially exposing relationships between plaintext blocks. Data integrity may also be affected due to incorrect cryptographic processing. There is no impact on availability. The attack requires network access but has high complexity and no privileges or user interaction are needed.

No official patch or fix is currently confirmed. To mitigate this issue, applications using libkcapi should avoid using the one-shot symmetric cipher APIs for inputs exceeding 64 KiB when continuous-message semantics are critical. Instead, they should use the streaming interface for processing large messages or ensure that one-shot inputs remain below the internal chunking threshold to guarantee consistent IV application throughout the operation. Monitor the vendor advisory for updates on official fixes.