CVE-2026-35199

OVERVIEW CVE-2026-35199 is a heap buffer overflow vulnerability in Microsoft's SymCrypt cryptographic library affecting versions 103.5.0 through 103.10.x. The flaw exists in the SymCryptXmssSign function, where a 64-bit leaf count value undergoes silent truncation when passed to a helper function expecting a 32-bit parameter. This truncation results in undersized scratch buffer allocation, triggering a heap buffer overflow during XMSS^MT signature computation for parameter sets with tree heights of 32 bits or greater, including standard predefined parameters. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.1 (MEDIUM) with a local attack vector requiring low complexity and user privileges. The attack has no confidentiality impact but carries moderate integrity implications and high availability impact through potential denial of service or memory corruption. The EPSS score of 0.00055 indicates minimal prevalence compared to other CVEs. Exploitation demands local access and would require an application to accept attacker-controlled XMSS^MT parameter sets during signing operations, a highly unusual scenario given that signing is a privileged private key operation. EXPLOITATION STATUS There is no evidence of active exploitation, no known public exploit code, and the vulnerability does not appear on the CISA KEV catalog or hot vulnerability lists. The practical risk is substantially mitigated by the fact that XMSS^MT signing is uncommon in production environments, designed for testing purposes only, and should be performed exclusively within Hardware Security Modules rather than in software implementations. Microsoft released a patch in version 103.11.0 and organizations should prioritize updating SymCrypt accordingly.