CVE-2025-67897
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS probability
- 0.35%
- CWE
- CWE-195
- Published
- 2025-12-14
- Last modified
- 2026-03-13
Affected products
- sequoia-pgp sequoia
Weakness type
Related vulnerabilities
- CVE-2026-85441 — MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length
- CVE-2026-18444 — Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
- CVE-2026-62959 — Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
- CVE-2026-55737 — Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
- CVE-2026-55991 — Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
- CVE-2026-49840 — FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
- CVE-2026-41682 — pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
- CVE-2026-26981 — OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp