Back to Security Advisories

OpenCryptoki Vulnerabilities — Ubuntu Security Update (USN-8707-1)

the affected product is affected by CVE-2026-40253 (and 2 related CVEs). openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3. CVSS base score: 6.8.

Critical 6.8 CVSS
Ubuntu 20.04 Ubuntu 22.04

Fix Commands

Debian/Ubuntu

sudo apt update && sudo apt upgrade

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in the affected product software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell the affected product under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)

It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could po…

  1. Ubuntu Security Notices

  2. USN-8707-1

Publication date

31 August 2026

Overview

Several security issues were fixed in openCryptoki.

Releases


26.04 LTS

Open side navigation

Packages

  • opencryptoki – A PKCS#11 Cryptographic Token Interface Standard implementation.

Details

It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)

It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could possibly use this issue to achieve
privilege escalation or access sensitive information. (CVE-2026-23893)

It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap
buffer overflow vulnerability. An attacker could possibly use this issue to
trigger heap corruption, or denial-of-service. (CVE-2026-22791)

It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)

It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could possibly use this issue to achieve
privilege escalation or access sensitive information. (CVE-2026-23893)

It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap
buffer overflow vulnerability. An attacker could possibly use this issue to
trigger heap corruption, or denial-of-service. (CVE-2026-22791)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 libopencryptoki-dev – 

3.26.0+dfsg-0ubuntu1.1
libopencryptoki0 – 

3.26.0+dfsg-0ubuntu1.1
opencryptoki – 

3.26.0+dfsg-0ubuntu1.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Related notices

Frequently Asked Questions

What is CVE-2026-40253?
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.
Is CVE-2026-40253 being exploited in the wild?
No confirmed exploitation is recorded. The EPSS model estimates a 0.16% probability of exploitation within the next 30 days — patch on your normal schedule.
How do I fix CVE-2026-40253?
Update the affected product to the patched release.Then confirm the running version matches the patched release listed above.
Why does this advisory list several CVEs?
One vendor release fixed multiple vulnerabilities. This advisory covers CVE-2026-40253, CVE-2026-23893, CVE-2026-22791 — updating to the patched release resolves all of them at once.

References

Security Advisories

Related Advisories

Plesk CVE-2026-68492: Untrusted Search Path

2026-09-23 00:00:00

Plesk CVE-2026-87898: OS Command Injection

2026-09-23 00:00:00

Virtualizor CVE-2026-43641: OS Command Injection

2026-09-22 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System