Is CVE-2026-118769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118769 being exploited in the wild.

How severe is CVE-2026-118769?

Informational severity, published 29 October 2026.

Which products and versions are affected?

Botan Project Botan 2.1.0 to 3.12.x.

How is CVE-2026-118769 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118769?

Check whether you run Botan Project Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118769: Botan integer overflow in block cipher block size FFI

CVE-2026-118769 · Severity: info · Published 2026-10-29

Botan is a C++ cryptography library used for secure data encryption and decryption. When an application using Botan's C API accepts external algorithm parameter strings and processes raw ECB mode, an attacker can cause memory corruption by selecting a cipher with a very large block size that overflows when converted to an integer, leading to undersized memory allocation. This could allow an attacker to corrupt memory and potentially achieve code execution in vulnerable applications.

Technologies: Botan Project Botan. Vendors: Botan Project.

Quick answers

Is CVE-2026-118769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118769 being exploited in the wild.
How severe is CVE-2026-118769?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Botan Project Botan 2.1.0 to 3.12.x.
Is there a fix for CVE-2026-118769?: Yes: fixed in Botan 3.13.0. Until then: Restrict access to algorithm parameter selection in applications using Botan's FFI; do not accept external algorithm specification strings when using raw ECB mode with block ciphers. Alternatively, disable or constrain use of variable-block-size ciphers like Cascade in security-sensitive deployments. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118769 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118769?: Check whether you run Botan Project Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Botan 3.13.0

Restrict access to algorithm parameter selection in applications using Botan's FFI; do not accept external algorithm specification strings when using raw ECB mode with block ciphers. Alternatively, disable or constrain use of variable-block-size ciphers like Cascade in security-sensitive deployments.

Technical details

The botan_block_cipher_block_size FFI function converts a size_t block size to int without bounds checking, allowing integer overflow/truncation when very large block sizes (e.g., from Cascade cipher constructions) are used. An attacker exploiting this via external algorithm parameter strings and raw ECB mode can trigger memory corruption through undersized buffer allocation. The C++ API and typical C API modes (CBC, CTR) are unaffected; only raw ECB mode with variable-block-size ciphers is vulnerable.

Affected products

Botan Project Botan 2.1.0 to 3.12.x

Timeline

2026-10-29: disclosed
2026-08-06: patched: Fix merged in PR #5805 with bounds checking added to botan_block_cipher_block_size

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.