CVE-2026-16459: Oberon PSA Crypto Padding Oracle Vulnerability

CVE-2026-16459 Overview

CVE-2026-16459 is a padding oracle vulnerability in Oberon microsystem AG's Oberon PSA Crypto library. The flaw exists in all versions from 1.0.0 up to (but not including) 2.1.1. An attacker can recover plaintexts by measuring timing differences in RSA PKCS#1 v1.5 decrypt operations. The vulnerability is categorized under [CWE-208] Observable Timing Discrepancy and represents a classic side-channel weakness in cryptographic implementations.

Critical Impact
An attacker with local access to timing measurements can recover plaintexts protected by RSA PKCS#1 v1.5 decryption, undermining the confidentiality guarantees of the cryptographic library.

Affected Products

Oberon PSA Crypto library version 1.0.0 and later
Oberon PSA Crypto library versions prior to 2.1.1
Applications and embedded systems linking the vulnerable Oberon PSA Crypto library for RSA PKCS#1 v1.5 operations

Discovery Timeline

2026-08-13 - CVE-2026-16459 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-16459

Vulnerability Analysis

The vulnerability is a padding oracle attack against RSA PKCS#1 v1.5 decryption, a variant of the Bleichenbacher class of attacks. The Oberon PSA Crypto library's RSA decryption path produces observable timing differences depending on whether the decrypted ciphertext has valid PKCS#1 v1.5 padding. An attacker who can measure decryption timing repeatedly can distinguish valid from invalid padding responses. By iteratively submitting adaptively chosen ciphertexts and observing the timing oracle, the attacker recovers the plaintext of a target ciphertext without direct access to the private key.

Root Cause

The root cause is non-constant-time handling of PKCS#1 v1.5 padding validation within the RSA decryption routine. Secure implementations must ensure the entire decryption path, including error handling for malformed padding, executes in constant time regardless of the padding validity. The affected versions leak padding validity through measurable execution time differences, providing the oracle required for the attack.

Attack Vector

The attack requires local access, which for embedded and PSA Crypto workloads typically means co-resident code, a compromised process on the same device, or physical access to observe timing. The attacker submits many crafted ciphertexts to the RSA PKCS#1 v1.5 decryption interface and records the time each operation takes. Statistical analysis over a large volume of measurements distinguishes valid from invalid padding, enabling Bleichenbacher-style plaintext recovery.

Because no verified proof-of-concept code is published, refer to the Oberon Security Advisory CVE-2026-16459 for authoritative technical details about the affected code paths and fix.

Detection Methods for CVE-2026-16459

Indicators of Compromise

High volumes of RSA decryption requests from a single local process or session, often numbering in the hundreds of thousands to millions per target ciphertext.
Repeated invocations of the PSA Crypto RSA PKCS#1 v1.5 decrypt interface with malformed or adaptively chosen ciphertexts.
Unusual CPU utilization spikes tied to a single cryptographic key or session lifetime.

Detection Strategies

Instrument the crypto library or wrapping application to count decryption failures per key and alert on abnormal failure rates.
Enable process-level auditing to identify local processes issuing sustained high-frequency calls to RSA decrypt APIs.
Correlate crypto API usage telemetry with process lineage to detect unexpected callers of PSA Crypto functions.

Monitoring Recommendations

Log all RSA PKCS#1 v1.5 decryption failures with a timestamp, calling process, and key identifier.
Establish baselines for normal decryption request volumes and alert on statistical deviations.
Forward crypto-operation logs to a centralized analytics platform for long-term trend analysis and anomaly detection.

How to Mitigate CVE-2026-16459

Immediate Actions Required

Upgrade Oberon PSA Crypto library to version 2.1.1 or later in all affected builds and firmware images.
Inventory all applications, devices, and embedded systems that link the Oberon PSA Crypto library and prioritize those exposing RSA decryption to local callers.
Where feasible, migrate protocols away from RSA PKCS#1 v1.5 encryption toward RSA-OAEP or hybrid schemes not susceptible to Bleichenbacher-style attacks.

Patch Information

Oberon microsystem AG has released Oberon PSA Crypto library version 2.1.1, which addresses the timing side channel in the RSA PKCS#1 v1.5 decryption implementation. Consult the Oberon Security Advisory CVE-2026-16459 for the fixed version and integration guidance.

Workarounds

Restrict local access to devices and processes that invoke RSA PKCS#1 v1.5 decryption using the vulnerable library.
Rate-limit RSA decryption operations per key or per caller to make timing oracle exploitation impractical.
Where the application protocol permits, disable PKCS#1 v1.5 decryption and require RSA-OAEP or authenticated key exchange alternatives.

bash

# Verify library version after upgrade
# Replace with the actual path/build system used in your project
grep -R "OBERON_PSA_CRYPTO_VERSION" ./include
# Expected: version string 2.1.1 or later