CVE-2026-34610
The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms. Prior to version 1.7.1, lc_x509_extract_name_segment() casts size_t vlen to uint8_t when storing the Common Name (CN) length. An attacker who crafts a certificate with CN = victim's CN + 256 bytes padding gets cn_size = (uint8_t)(256 + N) = N, where N is the victim's CN length. The first N bytes of the attacker's CN are the victim's identity. After parsing, the attacker's certificate has an identical CN to the victim's — enabling identity impersonation in PKCS#7 verification, certificate chain matching, and code signing. This issue has been patched in version 1.7.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-681
- Published
- 2026-04-02
- Last modified
- 2026-04-03
Affected products
- smuellerDD leancrypto
Weakness type
Related vulnerabilities
- CVE-2026-69438 — Microsoft JScript Remote Code Execution Vulnerability
- CVE-2026-84963 — Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
- CVE-2026-84966 — BSON element injection via NUL-embedded document keys in builder append
- CVE-2026-84970 — Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
- CVE-2026-82522 — libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
- CVE-2026-82457 — su-exec through 0.3 Privilege Escalation via Numeric User ID
- CVE-2026-75145 — FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
- CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation