PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44518 open-quantum-safe CVE debrief

liboqs prior to 0.16.0 contains an out-of-bounds read in XMSS and XMSS^MT stateful signature verification. When a signature buffer shorter than expected is supplied, the code reads past buffer bounds without validation. The excess bytes feed only into internal hash computation and are not returned to callers, preventing information leakage. The sole exploitable effect is potential process crash (denial of service) if the read accesses unmapped memory. This vulnerability is fixed in version 0.16.0.

Vendor
open-quantum-safe
Product
liboqs
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations deploying post-quantum cryptographic systems using liboqs for XMSS or XMSS^MT signatures, particularly those exposing signature verification to untrusted network input. Developers integrating stateful hash-based signatures into security-critical applications where availability is paramount.

Technical summary

The vulnerability exists in the XMSS and XMSS^MT stateful hash-based signature schemes implemented in liboqs. The verification function fails to check that the caller-provided signature buffer meets the minimum length requirement for the selected parameter set. When a short buffer is supplied, the implementation performs an out-of-bounds read during signature parsing. The read bytes are used exclusively as input to internal hash operations and are not exposed to the caller, eliminating information disclosure risk. The primary impact is potential segmentation fault and process termination if the memory access crosses into unmapped pages.

Defensive priority

medium

Recommended defensive actions

  • Upgrade liboqs to version 0.16.0 or later to remediate the out-of-bounds read vulnerability
  • Validate signature buffer lengths in application code before passing to liboqs verification functions if immediate patching is not feasible
  • Monitor application logs for unexpected crashes in cryptographic verification paths that may indicate exploitation attempts
  • Review custom integrations using liboqs XMSS or XMSS^MT for proper input validation practices

Evidence notes

CVE description confirms out-of-bounds read in XMSS/XMSS^MT verification with no information disclosure oracle. GitHub advisory and commit ef70dea7c85e5637f37828d75e5b9bb29dbfe513 provide fix confirmation. CVSS 5.3 (MEDIUM) reflects network-accessible denial of service with low attack complexity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44518 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44518

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44518 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44518

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.