Out-of-bounds read in Botan - CVE-2026-32877

Vulnerability identifier: #VU125381

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-32877

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the SM2 decryption authentication code value (C3) check when processing a crafted SM2 ciphertext with an undersized C3 hash field. A remote attacker can send a specially crafted SM2 ciphertext to cause a denial of service and disclose sensitive information.

The over-read is limited to up to 31 bytes and may result in other undefined behavior.

Botan
Fedora
openEuler
botan2-doc
python3-botan2
botan2-devel
botan2-debugsource
botan2-debuginfo
botan2
botan3

Install security update from vendor's website.

Botan - update to 3.11.0
botan2-doc - addressed in versions 2.19.3-6, 2.19.3-7
python3-botan2 - addressed in versions 2.19.3-6, 2.19.3-7
botan2-devel - addressed in versions 2.19.3-6, 2.19.3-7
botan2-debugsource - addressed in versions 2.19.3-6, 2.19.3-7
botan2-debuginfo - addressed in versions 2.19.3-6, 2.19.3-7
botan2 - addressed in versions 2.19.3-6, 2.19.3-7
botan3 - addressed in versions 3.9.0-3.el10_3, 3.9.0-4.el10_3, 3.9.0-6.fc44, 3.9.0-7.fc44

• https://github.com/randombit/botan/security/advisories/GHSA-7jj6-4r42-w9h6
• https://github.com/advisories/GHSA-7jj6-4r42-w9h6

• Multiple vulnerabilities in Botan
• Fedora 44 update for botan3
• Fedora EPEL 10.3 update for botan3
• Fedora 44 update for botan3
• Fedora EPEL 10.3 update for botan3
• openEuler 24.03 LTS SP3 update for botan2
• openEuler 24.03 LTS SP1 update for botan2
• openEuler 22.03 LTS SP4 update for botan2