Description
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opencryptoki | opencryptoki | >= 3.25.0, <= 3.26.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | opencryptoki | 3.26.0+dfsg-0ubuntu1.1 | USN-8707-1 |
| Ubuntu 25.10 | opencryptoki | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | openCryptoki | 3.26.0-150700.5.9.1 | SUSE-SU-2026:0291-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | openCryptoki | 3.26.0-160000.1.1 | SUSE-SU-2026:22365-1, SUSE-SU-2026:20434-1 |
| SLES 16.0 | openCryptoki | 3.26.0-160000.1.1 | SUSE-SU-2026:22365-1, SUSE-SU-2026:20434-1 |
| SLE Micro 6.2 | openCryptoki | 3.26.0-160000.1.1 | SUSE-SU-2026:22293-1, SUSE-SU-2026:20345-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openCryptoki | 3.26.0-3.1 | openSUSE-SU-2026:10048-1 |
| openSUSE Leap 16.0 | openCryptoki | 3.26.0-160000.1.1 | openSUSE-SU-2026:21059-1, openSUSE-SU-2026:20233-1 |
Advisories 9
- USN-8707-1 opencryptoki vulnerabilities Ubuntu Security Notices (USN) · Sep 2, 2026
- SUSE-SU-2026:22365-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21059-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22293-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:20233-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10048-1 openCryptoki-3.26.0-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20345-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20434-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0291-1 Security update for openCryptoki SUSE / openSUSE Security Updates · Mar 23, 2026