Medium severity6.6OSV Advisory· Published Jan 13, 2026· Updated Jun 17, 2026
CVE-2026-22791
CVE-2026-22791
Description
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10v3.25.0, v3.26.0+ 3 more
- (no CPE)range: v3.25.0, v3.26.0
- (no CPE)range: 3.25.0, 3.26.0
- cpe:2.3:a:opencryptoki_project:opencryptoki:3.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:opencryptoki_project:opencryptoki:3.26.0:*:*:*:*:*:*:*
- osv-coords6 versionspkg:rpm/suse/openCryptoki&distro=SUSE%20Linux%20Micro%206.2pkg:rpm/suse/openCryptoki&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/openCryptoki&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/openCryptoki&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7pkg:rpm/opensuse/openCryptoki&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openCryptoki&distro=openSUSE%20Leap%2016.0
< 3.26.0-160000.1.1+ 5 more
- (no CPE)range: < 3.26.0-160000.1.1
- (no CPE)range: < 3.26.0-160000.1.1
- (no CPE)range: < 3.26.0-160000.1.1
- (no CPE)range: < 3.26.0-150700.5.9.1
- (no CPE)range: < 3.26.0-3.1
- (no CPE)range: < 3.26.0-160000.1.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.