Is CVE-2026-104254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104254 being exploited in the wild.

How severe is CVE-2026-104254?

Medium severity, with a CVSS score of 5.3, published 6 November 2026.

Which products and versions are affected?

Open Quantum Safe Liboqs 0.11.0 through 0.16.0.

Is there a fix for CVE-2026-104254?

Yes: fixed in 0.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104254 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104254?

Check whether you run Open Quantum Safe Liboqs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104254: liboqs out-of-bounds read in HSS/LMS signature verification

CVE-2026-104254 · Severity: medium · CVSS 5.3 · Published 2026-11-06

liboqs is a C cryptographic library implementing post-quantum algorithms. When verifying HSS-LMS signatures with truncated or malformed input, the library reads up to 32 bytes beyond the caller's buffer, causing a possible crash or denial of service. An attacker need only provide a plausibly-formatted public key and truncated signature to trigger the vulnerability; no valid signature is required.

Technologies: Open Quantum Safe Liboqs. Vendors: Open Quantum Safe.

Quick answers

Is CVE-2026-104254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104254 being exploited in the wild.
How severe is CVE-2026-104254?: Medium severity, with a CVSS score of 5.3, published 6 November 2026.
Which products and versions are affected?: Open Quantum Safe Liboqs 0.11.0 through 0.16.0.
Is there a fix for CVE-2026-104254?: Yes: fixed in 0.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104254 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104254?: Check whether you run Open Quantum Safe Liboqs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.17.0

Technical details

Out-of-bounds read in hss_validate_signature_init() and is_hss_public_key() in the LMS signature verification path (src/sig_stfl/lms/external/hss_verify_inc.c) when OQS_ENABLE_SIG_STFL_LMS=ON. The vulnerability occurs because length checks enforce only a 4-byte minimum before parsing a 12-byte header and reading the LM-OTS randomizer field; an attacker-controlled truncated signature reaches the verification functions with fully attacker-controlled bytes. The read data is processed only by internal hash operations and not disclosed; impact is verifier crash and denial of service.

Affected products

Open Quantum Safe liboqs 0.11.0 through 0.16.0

Timeline

2026-11-06: disclosed: CVE-2026-104254 published
2026-09-09: patched: Fix merged in PR #2507

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.