CVE-2026-118769
Botan is a C++ cryptography library
- Risk score
- 60/100
- CVSS
- 9.2 v4.0
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.13.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.2 critical
- Remotely exploitable without logging in
References
Original description
Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.
Last activity 29 Oct 2026. Patch Forecast updates every hour.