CVE-2026-40253

OVERVIEW CVE-2026-40253 is a buffer overflow vulnerability in openCryptoki versions 3.26.0 and below, a PKCS#11 cryptographic library used on Linux and AIX systems. The vulnerability exists in the BER/DER decoding functions within the shared common library (asn1.c), which fail to validate attacker-controlled length fields against actual buffer boundaries. All five primitive decoders are affected, and the issue impacts all token backends including Soft, ICA, CCA, TPM, EP11, and ICSF since the vulnerable code is centralized in the common library. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.1 (MEDIUM) with a local attack vector requiring no privileges but user interaction. The primary impact is availability, with attackers able to trigger out-of-bounds reads through malformed BER-encoded cryptographic objects supplied via PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication. Additionally, the ber_decode_INTEGER function can produce integer underflows when processing zero-length encodings, compounding the risk. EXPLOITATION STATUS The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00013 indicates very low real-world exploitation probability relative to other CVEs. A patch is available through commit ed378f463ef73364c89feb0fc923f4dc867332a3, and community attention remains minimal given the specialized nature of PKCS#11 implementations in enterprise cryptographic environments.