CVE-2026-5260
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A flaw was found in libgnutls where a short heap overread occurs. A remote attacker can trigger memory corruption by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token.
Risk Assessment
This vulnerability could lead to information disclosure, potentially exposing sensitive data from server memory, posing a risk of data leakage for the organization.
Recommendation
Immediately update the libgnutls library to a version containing the fix for this vulnerability.
Original NVD description (English source)
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.