CVE-2026-32877: Botan C++ Buffer Overflow Vulnerability

CVE-2026-32877 Overview

CVE-2026-32877 is a heap-based out-of-bounds read vulnerability in the Botan C++ cryptography library affecting SM2 decryption operations. The vulnerability exists from version 2.3.0 to before version 3.11.0, where the authentication code value (C3) validation fails to verify the expected length of the encoded value before comparison. An attacker can exploit this flaw by providing an invalid ciphertext, triggering a heap over-read of up to 31 bytes, which can result in application crashes or potentially other undefined behavior.

Critical Impact

This vulnerability enables denial of service through application crashes and may lead to information disclosure or undefined behavior due to improper memory access during SM2 decryption operations.

Affected Products

• Botan C++ cryptography library versions 2.3.0 to 3.10.x
• Applications and systems integrating vulnerable Botan versions for SM2 cryptographic operations
• Services utilizing SM2 decryption functionality through the Botan library

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-32877 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32877

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when the software reads data past the end of the intended buffer. In the context of the Botan cryptography library, the flaw manifests during SM2 decryption operations—specifically in the code responsible for validating the authentication code component (C3) of the SM2 ciphertext structure.

SM2 is a Chinese national cryptographic standard that includes public key encryption, digital signatures, and key exchange algorithms. During the decryption process, the C3 component serves as a hash-based authentication code that verifies the integrity of the encrypted message. The vulnerable code path performs a comparison operation on the C3 value without first validating that the encoded value matches the expected length, creating a boundary condition where the comparison may read beyond allocated memory.

Root Cause

The root cause is an improper input validation error in the SM2 decryption routine. The code fails to enforce a length check on the authentication code (C3) field before performing memory comparison operations. When a maliciously crafted ciphertext with an incorrectly sized C3 component is processed, the comparison function continues reading memory beyond the intended buffer boundaries, potentially accessing up to 31 bytes of adjacent heap memory.

Attack Vector

The attack can be executed remotely over the network by supplying specially crafted invalid SM2 ciphertext to any application using a vulnerable version of the Botan library. The attacker does not require authentication or user interaction to trigger the vulnerability. The exploitation scenario involves:

1. Identifying an application or service that uses Botan for SM2 decryption
2. Crafting a malformed SM2 ciphertext with an authentication code (C3) of unexpected length
3. Sending the malicious ciphertext to the target service
4. The heap over-read is triggered when the decryption routine attempts to validate the C3 component

The vulnerability can cause application crashes leading to denial of service, and depending on memory layout and application behavior, may potentially leak sensitive information from adjacent heap memory or trigger other undefined behavior.

Detection Methods for CVE-2026-32877

Indicators of Compromise

• Unexpected application crashes or segmentation faults in services performing SM2 decryption operations
• Abnormal memory access patterns or memory corruption errors in applications using the Botan library
• Increased error rates in cryptographic operations with malformed input handling

Detection Strategies

• Monitor application logs for SM2 decryption failures accompanied by memory-related errors or crashes
• Implement runtime memory sanitizers (ASan, MSan) in development and testing environments to detect out-of-bounds read attempts
• Deploy intrusion detection signatures that identify malformed SM2 ciphertext structures with abnormal C3 field lengths

Monitoring Recommendations

• Enable detailed logging for cryptographic operations, particularly SM2 decryption failures
• Configure application crash monitoring and alerting for services using the Botan library
• Audit and inventory all systems and applications that incorporate Botan versions between 2.3.0 and 3.10.x

How to Mitigate CVE-2026-32877

Immediate Actions Required

• Upgrade all Botan library installations to version 3.11.0 or later immediately
• Identify and inventory all applications and services using vulnerable Botan versions for SM2 operations
• Implement input validation at the application layer to reject malformed ciphertext before passing to the decryption function
• Consider temporarily disabling SM2 decryption functionality if upgrading is not immediately feasible

Patch Information

The vulnerability has been patched in Botan version 3.11.0. Organizations should update to this version or later to remediate the vulnerability. The patch adds proper length validation for the C3 authentication code component before performing the comparison operation during SM2 decryption. For detailed patch information and the security advisory, refer to the GitHub Security Advisory.

Workarounds

• Implement strict input validation to verify SM2 ciphertext structure and component lengths before processing
• Deploy network-level filtering to sanitize or reject potentially malicious cryptographic payloads
• Isolate services performing SM2 decryption in sandboxed environments to limit the impact of potential crashes
• Consider using alternative cryptographic libraries for SM2 operations until the patch can be applied

# Verify Botan version and update
# Check installed Botan version
botan version

# Update Botan to patched version 3.11.0 or later
# Example using package manager or from source
git clone https://github.com/randombit/botan.git
cd botan
git checkout 3.11.0
./configure.py
make
sudo make install