CVE-2026-104254
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In liboqs from 0.11.0 through 0.16.0, builds with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. hss_validate_signature_init() does not ensure the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer, and in 0.16.0 is_hss_public_key() reads at offset 8 after only a four-byte length check.
Risk Assessment
A verifier crash and denial of service are possible. The read data is consumed only by an internal hash and is not exposed, so there is no memory disclosure or acceptance of an invalid signature.
Recommendation
Plan to upgrade liboqs to version 0.17.0, where the fix is scheduled. Until then, consider disabling OQS_ENABLE_SIG_STFL_LMS if not required.
Other vulnerabilities in liboqs
See all- CVE-2026-47738Medium
liboqs prior to 0.16.0 can dereference an uninitialized encaps_derand function pointer in OQS_KEM_encaps_derand for six NTRU schemes (NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, NTRU-HRSS-1373). The affected constructors omit the encaps_derand member and OQS_KEM objects are allocated without zero initialization. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it.
- CVE-2026-44519Medium
In liboqs, the ct_select function in the FrodoKEM implementation (AES and SHAKE variants) lacks a value barrier in the Fujisaki-Okamoto implicit-rejection path. When compiled with Clang 17 or later at an optimization level such as -Os, the compiler can emit a secret-dependent conditional load, allowing success and rejection paths to be distinguished by cache residency.
- CVE-2026-46344Medium
liboqs prior to version 0.16.0 has an out-of-bounds read vulnerability in the XMSS and XMSS^MT signature verification code, potentially leading to a crash (denial of service).
- CVE-2026-44518Medium
In liboqs before 0.16.0, an out-of-bounds read occurs in XMSS/XMSS^MT signature verification when the signature buffer is shorter than expected. The implementation does not validate the length and reads past the buffer, potentially causing a crash (DoS).
Original NVD description (English source)
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS