CVE-2014-9087

CVE-2014-9087 describes an integer underflow vulnerability in the ksba_oid_to_str function of Libksba versions prior to 1.3.2, impacting products like GnuPG, Debian, and Canonical. This flaw allows remote attackers to trigger a denial of service (crash) via a crafted OID within S/MIME messages or ECC-based OpenPGP data, leading to a buffer overflow. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector and low attack complexity, potentially resulting in partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.