CVE-2026-104267
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Botan from 2.7.0 until 3.13.0, the Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than subsequently written data. This can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer.
Risk Assessment
An attacker can trigger an immediate process crash (denial of service), and arbitrary code execution cannot be excluded from the overwrite primitive. Affects systems that enable Scrypt and accept parameters from a hostile source.
Recommendation
Upgrade Botan to version 3.13.0 or later. Avoid accepting arbitrary Scrypt parameters from untrusted sources.
Other vulnerabilities in Botan
See all- CVE-2015-7825High
Botan before 1.11.22 improperly validates certificate paths, allowing remote attackers to cause a denial of service via a certificate with a loop in the certificate chain.
- CVE-2015-7824High
Botan versions 1.11.x before 1.11.22 are vulnerable to a padding-oracle attack that allows remote attackers to decrypt TLS ciphertext data using CBC ciphersuites.
- CVE-2016-2850High
Botan versions 1.11.x before 1.11.29 do not enforce TLS policy for signature algorithms and ECC curves, allowing remote attackers to conduct downgrade attacks.
- CVE-2016-2849High
Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.
- CVE-2016-2194High
The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.
- CVE-2015-7827High
Botan before 1.10.13 and 1.11.x before 1.11.22 makes it easier for remote attackers to conduct million-message attacks by measuring time differences related to decoding of PKCS#1 padding.
- CVE-2015-5727High
The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.
- CVE-2015-5726High
The BER decoder in Botan versions 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause an application crash via an empty BIT STRING in ASN.1 data.
- CVE-2014-9742High
The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, making it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.
- CVE-2026-118769Critical
In the Botan C++ cryptography library, the C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher, causing the reported size to be truncated, insufficient memory allocation, and later memory corruption. The issue is fixed in version 3.13.0.
Original NVD description (English source)
Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS