PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9132 Botan Project CVE debrief

CVE-2016-9132 affects Botan releases 1.8.0 through 1.11.33. When BER data is decoded, an integer overflow can cause an incorrect length field to be computed. If an application then trusts and uses that attacker-influenced length value, the result can be memory corruption or another failure. Because the issue can be triggered through untrusted input and the CVSS score is 9.8, this should be treated as a high-priority patching item for any software that uses Botan for BER parsing.

Vendor
Botan Project
Product
Botan
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Developers and operators of applications that embed Botan, especially software that decodes BER-encoded data from untrusted sources and any code that uses the returned length value in later memory operations.

Technical summary

The NVD record describes a CWE-190 integer overflow in Botan's BER decoding path. For versions 1.8.0 through 1.11.33, malformed input can lead to an incorrect length field being computed. The risk is not limited to the decoder itself: any API caller that consumes that returned length without robust validation may later perform unsafe memory handling, which can cascade into corruption or process failure.

Defensive priority

Critical — patch immediately, especially on systems that parse attacker-controlled BER input.

Recommended defensive actions

  • Inventory all products and services that link against Botan and confirm whether they decode BER data.
  • Upgrade to a Botan release that includes the upstream fix referenced by commit 987ad747db6d0d7e36f840398f3cf02e2fbfd90f.
  • Treat any use of BER parsing on untrusted input as high risk until patched.
  • Audit callers that rely on decoded length fields and add explicit bounds validation before any memory-sensitive use.
  • Prioritize remediation for internet-facing or remotely reachable services.
  • Track downstream vendor package advisories, including the Fedora package announcements linked in the record, for packaged fixes.

Evidence notes

The supplied NVD record states that Botan 1.8.0 through 1.11.33 are affected and that an integer overflow during BER decoding can produce an incorrect length field. NVD classifies the weakness as CWE-190 and assigns CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The CVE was published on 2017-01-30T22:59:00.827Z and later modified on 2026-05-13T00:24:29.033Z; use the publication date for disclosure timing. The corpus also includes the upstream Botan patch commit and third-party/package advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9132 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9132

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9132 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9132

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.