Threats affecting pkg:github/microsoft/SymCrypt

CVE-2026-35199 is a heap-based buffer overflow vulnerability in Microsoft SymCrypt versions 103.5.0 up to but not including 103.11.0. The issue arises in the SymCryptXmssSign function when a 64-bit leaf count is truncated to 32 bits, causing an undersized buffer allocation and subsequent overflow during signature computation. Exploitation requires an application to perform XMSS^MT signing with attacker-controlled parameters, which is uncommon and generally restricted to trusted private keys or hardware security modules. This vulnerability is fixed in SymCrypt version 103.11.0.