CVE-2026-16458: ocrypto Library Padding Oracle Vulnerability

CVE-2026-16458 Overview

CVE-2026-16458 is a padding oracle vulnerability in Oberon microsystems AG's ocrypto cryptographic library. The flaw affects all versions from 3.0.0 up to but not including 4.0.1. An attacker with local access can recover plaintexts by measuring the timing of RSA PKCS#1 v1.5 decryption operations. The issue is classified under CWE-208: Observable Timing Discrepancy. Successful exploitation compromises confidentiality of data protected by RSA PKCS#1 v1.5, including session keys and encrypted messages processed by embedded systems using ocrypto.

Critical Impact
Local attackers can recover RSA-decrypted plaintexts through side-channel timing analysis, undermining the confidentiality guarantees of cryptographic operations built on ocrypto.

Affected Products

Oberon microsystems AG ocrypto library versions 3.0.0 through 4.0.0
Embedded and IoT applications linking vulnerable ocrypto builds
Downstream products bundling ocrypto for RSA PKCS#1 v1.5 decryption

Discovery Timeline

2026-08-13 - CVE CVE-2026-16458 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-16458

Vulnerability Analysis

The vulnerability is a classic padding oracle side channel affecting RSA PKCS#1 v1.5 decryption in ocrypto. When the library decrypts a ciphertext, the time required to complete the operation varies based on whether the resulting plaintext contains valid PKCS#1 v1.5 padding. An attacker who can submit chosen ciphertexts and precisely measure response times learns one bit of information per query about the padding structure. Through iterative adaptive queries, this leakage allows full recovery of the original plaintext, following the well-known Bleichenbacher attack pattern.

Because the attack path is Local, the adversary must be positioned on the same host or in a co-resident execution environment where timing can be measured reliably. In embedded contexts using ocrypto, this can include untrusted applications running on the same device or an attacker with debug-level access to the target.

Root Cause

The root cause is non-constant-time handling of PKCS#1 v1.5 padding validation and downstream processing during RSA decryption. Branches and memory access patterns that depend on padding validity introduce measurable timing discrepancies [CWE-208]. Constant-time RSA decryption implementations must produce identical execution profiles regardless of padding correctness, typically by returning a pseudo-random plaintext of expected length when padding is invalid.

Attack Vector

An attacker with local access observes decryption timing for crafted RSA ciphertexts submitted to an application using ocrypto. By statistically analyzing timing distributions across many oracle queries, the attacker learns whether each ciphertext decrypts to a PKCS#1 v1.5 conformant message. Iteratively narrowing the plaintext space using Bleichenbacher's algorithm eventually reveals the full original plaintext, including any wrapped symmetric key. Refer to the Oberon Security Advisory CVE-2026-16458 for vendor-provided technical details.

Detection Methods for CVE-2026-16458

Indicators of Compromise

High-volume, repetitive RSA decryption requests originating from a single local process or user context
Unusual sequences of malformed or randomized ciphertexts submitted to services performing PKCS#1 v1.5 decryption
Local processes performing precise timing measurements or accessing high-resolution timers during cryptographic operations

Detection Strategies

Inventory all software linking ocrypto versions 3.0.0 through 4.0.0 using software composition analysis
Instrument applications to log the frequency and source of RSA PKCS#1 v1.5 decryption calls
Alert on anomalous local processes issuing sustained cryptographic oracle queries against a service

Monitoring Recommendations

Track process-level telemetry for unexpected access to cryptographic APIs exposed by applications using ocrypto
Monitor for the introduction of new binaries or libraries on embedded devices that could serve as measurement harnesses
Correlate authentication and TLS handshake failures that could indicate active Bleichenbacher-style probing

How to Mitigate CVE-2026-16458

Immediate Actions Required

Upgrade ocrypto to version 4.0.1 or later across all deployed systems and firmware images
Audit application code to identify direct or indirect use of RSA PKCS#1 v1.5 decryption via ocrypto
Restrict local access to devices and services performing RSA decryption to trusted users and workloads only

Patch Information

Oberon microsystems AG addressed the vulnerability in ocrypto version 4.0.1. All versions from 3.0.0 up to but not including 4.0.1 are affected. Refer to the Oberon Security Advisory CVE-2026-16458 for release details and integration guidance.

Workarounds

Where feasible, migrate cryptographic protocols from RSA PKCS#1 v1.5 to RSA-OAEP, which is not susceptible to this padding oracle
Enforce strict process isolation on embedded devices to prevent untrusted local code from observing cryptographic timing
Rate-limit RSA decryption operations exposed to callers to reduce the practicality of high-volume oracle queries

bash

# Configuration example
# Verify installed ocrypto version and upgrade if vulnerable
strings /path/to/binary | grep -i ocrypto
# Rebuild and redeploy with ocrypto >= 4.0.1