CVE-2026-22791: openCryptoki Buffer Overflow Vulnerability

CVE-2026-22791 Overview

CVE-2026-22791 is a heap buffer overflow vulnerability discovered in openCryptoki, a PKCS#11 library and tools for Linux and AIX. The vulnerability exists in the CKM_ECDH_AES_KEY_WRAP implementation and affects versions 3.25.0 and 3.26.0. An attacker with local access can exploit this flaw by supplying a compressed EC public key and invoking C_WrapKey, causing out-of-bounds writes in the host process. This can lead to heap corruption or denial-of-service conditions.

Critical Impact

Local attackers can cause heap corruption or denial-of-service by exploiting improper buffer size calculations in the ECDH AES key wrap mechanism.

Affected Products

• openCryptoki version 3.25.0
• openCryptoki version 3.26.0
• Linux and AIX systems using affected openCryptoki versions

Discovery Timeline

• January 13, 2026 - CVE-2026-22791 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22791

Vulnerability Analysis

This heap buffer overflow vulnerability stems from CWE-131 (Incorrect Calculation of Buffer Size) in the CKM_ECDH_AES_KEY_WRAP mechanism implementation. When processing elliptic curve cryptographic operations, the vulnerable code fails to properly validate and calculate the required buffer size when handling compressed EC public keys during key wrapping operations.

The CKM_ECDH_AES_KEY_WRAP mechanism is used for secure key exchange and wrapping operations in PKCS#11 implementations. When an attacker supplies a specially crafted compressed EC public key and invokes the C_WrapKey function, the implementation writes beyond the allocated heap buffer boundaries. This occurs because the code does not adequately account for the decompressed key size when allocating memory for the operation.

Root Cause

The root cause is categorized as CWE-131: Incorrect Calculation of Buffer Size. The vulnerability occurs because the buffer allocation logic does not properly account for the expanded size of compressed EC public keys when they are processed during the key wrap operation. The code fails to validate that the CK_ECDH_AES_KEY_WRAP_PARAMS structure contains appropriate bounds for the operation, allowing malformed input to trigger out-of-bounds memory writes.

Attack Vector

The attack requires local access to the system and low privileges to execute. An attacker must be able to interact with the openCryptoki library through PKCS#11 API calls. The attack flow involves:

1. The attacker creates a malicious compressed EC public key
2. The attacker invokes C_WrapKey with CKM_ECDH_AES_KEY_WRAP mechanism
3. The implementation processes the compressed key without proper size validation
4. Out-of-bounds writes occur in the heap, corrupting adjacent memory structures

The following patch demonstrates the security fix implemented in the encryption manager (usr/lib/common/encr_mgr.c):

        ctx->context_len = 0;
        ctx->context = NULL;
        break;
+    case CKM_ECDH_AES_KEY_WRAP:
+        /* CKM_ECDH_AES_KEY_WRAP can only be used for wrap/unwrap */
+        if (operation != OP_WRAP) {
+            TRACE_ERROR("%s\n", ock_err(ERR_MECHANISM_INVALID));
+            rc = CKR_MECHANISM_INVALID;
+            goto done;
+        }
+
+        if (mech->ulParameterLen != sizeof(CK_ECDH_AES_KEY_WRAP_PARAMS) ||
+            mech->pParameter == NULL) {
+            TRACE_ERROR("%s\n", ock_err(ERR_MECHANISM_PARAM_INVALID));
+            rc = CKR_MECHANISM_PARAM_INVALID;
+            goto done;
+        }
+
+        rc = template_attribute_get_ulong(key_obj->template, CKA_KEY_TYPE,
+                                          &keytype);
+        if (rc != CKR_OK) {
+            TRACE_ERROR("Could not find CKA_KEY_TYPE for the key.\n");
+            goto done;
+        }
+
+        if (keytype != CKK_EC) {
+            TRACE_ERROR("%s\n", ock_err(ERR_KEY_TYPE_INCONSISTENT));
+            rc = CKR_KEY_TYPE_INCONSISTENT;
+            goto done;
+        }

Source: GitHub Commit

Detection Methods for CVE-2026-22791

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using openCryptoki library
• Anomalous memory access patterns in processes utilizing PKCS#11 operations
• Log entries showing CKR_MECHANISM_PARAM_INVALID or CKR_KEY_TYPE_INCONSISTENT errors in rapid succession
• Evidence of heap corruption in core dumps from openCryptoki-dependent applications

Detection Strategies

• Monitor system logs for unusual PKCS#11 operation failures, particularly those involving CKM_ECDH_AES_KEY_WRAP mechanism
• Implement memory corruption detection tools such as AddressSanitizer on systems running affected versions
• Deploy endpoint detection solutions that can identify heap overflow exploitation attempts
• Audit application logs for repeated C_WrapKey invocations with EC key types

Monitoring Recommendations

• Enable detailed logging for openCryptoki operations to capture parameter validation failures
• Configure system crash reporting to capture and analyze core dumps from cryptographic operations
• Implement file integrity monitoring on openCryptoki library files to detect unauthorized modifications
• Set up alerts for processes consuming abnormal memory during PKCS#11 operations

How to Mitigate CVE-2026-22791

Immediate Actions Required

• Update openCryptoki to a patched version that includes the security fixes
• Restrict local access to systems running vulnerable openCryptoki versions to authorized users only
• Review and audit applications that use the CKM_ECDH_AES_KEY_WRAP mechanism
• Consider temporarily disabling EC key wrap operations if updates cannot be immediately applied

Patch Information

Security patches have been released to address this vulnerability. The fixes implement proper parameter validation for the CKM_ECDH_AES_KEY_WRAP mechanism, including verification of parameter length and key type consistency. Organizations should apply the following commits:

• Commit 785d7577 - Adds support and validation for CKM_ECDH_AES_KEY_WRAP in key/encrypt/decrypt manager
• Commit e37e9127 - Additional security hardening

For complete details, refer to the GitHub Security Advisory GHSA-26f5-3mwq-4wm7.

Workarounds

• Limit local user access to systems running openCryptoki to reduce the attack surface
• If possible, disable or restrict access to the CKM_ECDH_AES_KEY_WRAP mechanism until patches can be applied
• Implement application-level controls to validate EC key inputs before passing to PKCS#11 operations
• Deploy runtime application self-protection (RASP) solutions to detect memory corruption attempts

# Configuration example
# Check installed openCryptoki version
pkcsconf -v

# Verify library version to confirm vulnerability status
rpm -qa | grep opencryptoki
# or for Debian-based systems
dpkg -l | grep opencryptoki

# After updating, restart services using openCryptoki
systemctl restart pkcsslotd