CVE-2026-32877 Details
Description
Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison. An invalid ciphertext can cause a heap over-read of up to 31 bytes, resulting in a crash or potentially other undefined behavior. This issue has been patched in version 3.11.0.
A heap buffer over-read vulnerability has been identified in the Botan C++ cryptography library, specifically in versions 2.3.0 prior to 3.11.0. The issue arises during SM2 decryption, where the authentication code value (C3) is not properly validated for length before comparison. This oversight allows an invalid ciphertext to cause a heap over-read of up to 31 bytes, leading to a process crash or potentially other undefined behavior. The vulnerability is particularly relevant for applications using SM2 encryption in Chinese standards-compliant TLS, payment systems, and enterprise applications that process attacker-controlled ciphertexts over the network.
Users can upgrade to Botan version 3.11.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/randombit/botan/security/advisories/GHSA-7jj6-4r42-w9h6 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| botan project botan | >= 2.3.0, < 3.11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |