How severe is CVE-2026-22791?

CVE-2026-22791 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.

Is CVE-2026-22791 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-22791?

CVE-2026-22791 primarily affects Opencryptoki Project Opencryptoki. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-22791?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-22791 have an EU (EUVD) identifier?

Yes. CVE-2026-22791 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2415.

When was CVE-2026-22791 published?

CVE-2026-22791 was published on 2026-01-13 and last updated on 2026-06-17.

CVE-2026-22791

CVE-2026-22791 is a medium-severity vulnerability in Opencryptoki Project Opencryptoki with a CVSS 3.x base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-131.

Key facts

Severity: Medium (CVSS 3.x base score 6.6)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-2415
Weakness: CWE-131
Affected product: Opencryptoki Project Opencryptoki
Published: 2026-01-13
Last modified: 2026-06-17

Description

openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.

Frequently asked questions

What is CVE-2026-22791?: openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
How severe is CVE-2026-22791?: CVE-2026-22791 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.
Is CVE-2026-22791 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-22791?: CVE-2026-22791 primarily affects Opencryptoki Project Opencryptoki. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-22791?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-22791 have an EU (EUVD) identifier?: Yes. CVE-2026-22791 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2415.
When was CVE-2026-22791 published?: CVE-2026-22791 was published on 2026-01-13 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:opencryptoki_project:opencryptoki:3.25.0:*:*:*:*:*:*:*
cpe:2.3:a:opencryptoki_project:opencryptoki:3.26.0:*:*:*:*:*:*:*

More vulnerabilities in Opencryptoki Project Opencryptoki

CVE-2026-40253 — Medium (CVSS 6.8): openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER…
CVE-2026-23893 — Medium (CVSS 6.8): openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to…
CVE-2012-4455 — Medium (CVSS 6.2): openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink…
CVE-2024-0914 — Medium (CVSS 5.9): A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5…
CVE-2021-3798 — Medium (CVSS 5.5): A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is…
CVE-2012-4454 — Low (CVSS 2.9): openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on…

All CVEs affecting Opencryptoki Project Opencryptoki →

Other CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities

CVE-2026-52955 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in…
CVE-2026-41676 — Critical (CVSS 9.8): rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78,…
CVE-2026-1949 — Critical (CVSS 9.8): Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of…
CVE-2026-20911 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and…
CVE-2025-1861 — Critical (CVSS 9.8): In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when…
CVE-2023-5941 — Critical (CVSS 9.8): In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the…

Browse all CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities →