CVE-2026-118769 Botan: Integer overflow when reporting block size in FFI can cause memory corruption
CriticalCVSS 9.2
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/ansible-automation-platform-27/hub-rhel9(Red Hat:ansible_automation_platform:2) | All versions | No fix listed |
| redhat/rust-podman-sequoia(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/rust-sequoia-sq(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/rust-sequoia-sqv(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/rust-sequoia-sq(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| randombit botan | = >= 2.1.0, < 3.13.0 | No fix listed |
| debian/botan(Debian:12) | All versions | No fix listed |
| debian/botan(Debian:12) | = 2.19.3+dfsg-1 | No fix listed |
| debian/botan(Debian:12) | = 2.19.3+dfsg-1+deb12u1 | No fix listed |
| debian/botan(Debian:12) | = 2.19.4+dfsg-1 | No fix listed |
| debian/botan(Debian:12) | = 2.19.5+dfsg-1 | No fix listed |
| debian/botan(Debian:12) | = 2.19.5+dfsg-2 | No fix listed |
| debian/botan(Debian:12) | = 2.19.5+dfsg-3 | No fix listed |
| debian/botan(Debian:12) | = 2.19.5+dfsg-4 | No fix listed |
| debian/botan(Debian:13) | All versions | No fix listed |
| debian/botan(Debian:13) | = 2.19.5+dfsg-4 | No fix listed |
| debian/botan3(Debian:13) | All versions | No fix listed |
| debian/botan3(Debian:13) | = 3.10.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.10.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.11.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.11.1+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.11.1+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.12.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.12.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.12.0+dfsg-2~deb13u1 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/botan3(Debian:13) | = 3.13.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.13.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.7.1+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.8.1+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.9.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:13) | = 3.9.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:13) | = 3.9.0+dfsg-2.1 | No fix listed |
| debian/botan3(Debian:14) | < 3.13.0+dfsg-2 | 3.13.0+dfsg-2 |
| debian/botan3(Debian:14) | = 3.10.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.10.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:14) | = 3.11.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.11.1+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.11.1+dfsg-2 | No fix listed |
| debian/botan3(Debian:14) | = 3.12.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.12.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:14) | = 3.12.0+dfsg-2~deb13u1 | No fix listed |
| debian/botan3(Debian:14) | = 3.13.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.7.1+dfsg-2 | No fix listed |
| debian/botan3(Debian:14) | = 3.8.1+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.9.0+dfsg-1 | No fix listed |
| debian/botan3(Debian:14) | = 3.9.0+dfsg-2 | No fix listed |
| debian/botan3(Debian:14) | = 3.9.0+dfsg-2.1 | No fix listed |
| ubuntu/botan(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/botan(Ubuntu:24.04) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2563613 issue-tracking
- www.cve.org
- nvd.nist.gov
- https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3
- https://github.com/randombit/botan/pull/5805
- https://github.com/randombit/botan/security/advisories/GHSA-c68p-822g-jfvr
- Debian Security Tracker CVE-2026-118769 vendor-advisory
- Ubuntu CVE tracker vendor-advisory