9.2
CriticalCVSS 4.0 · from GitHub_M
CVE-2026-118769
Botan: Integer overflow when reporting block size in FFI can cause memory corruption
botan · Out-of-bounds read · CWE-125Affectedbotan
FixNo fix listed yet.
PublishedOct 29, 17:22 · GitHub_M
ScoredOct 29 · 9.2 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inbotan>= 2.1.0, < 3.13.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known