CVE-2016-4355

CVE-2016-4355 describes multiple integer overflow vulnerabilities in Libksba versions prior to 1.3.3, specifically within the ber-decoder.c component. These flaws, affecting products like Canonical and GnuPG's Libksba, allow remote attackers to trigger a denial of service (crash) through crafted BER data, leading to a buffer overflow. With a CVSSv3 score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity and no user interaction or privileges required, resulting in a high impact on availability. The EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a lack of widespread attention.