VDB
CVE-2026-22791
CVE-2026-22791
PUBLISHED
CVSS 6.599999904632568 MEDIUM
openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.
EPSS 0.28% · 20.8th percentile
Risk Scores
CVSS 3.1
6.599999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
EPSS Score
0.28%
20.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| opencryptoki_project | opencryptoki | 3.25.0, 3.26.0 |
| opencryptoki | opencryptoki | * |
Timeline
- Jan 13, 2026 CVE Published
- Jan 14, 2026 EPSS Score
- Jan 18, 2026 EPSS Score
- Jan 21, 2026 EPSS Score
- Jan 25, 2026 EPSS Score
- Jan 29, 2026 EPSS Score
- Feb 1, 2026 EPSS Score
- Feb 3, 2026 CVE Updated
- Feb 5, 2026 EPSS Score
- Feb 9, 2026 EPSS Score
- Feb 12, 2026 EPSS Score
- Feb 16, 2026 EPSS Score