# CVE-2026-118769: Botan integer overflow in block cipher block size FFI

Source: https://junglewise.ai/threats/cve-2026-118769-botan-is-a-c-cryptography-library-from-2-1-0-until-3-13-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118769 · Severity: info · Published 2026-10-29

Botan is a C++ cryptography library used for secure data encryption and decryption. When an application using Botan's C API accepts external algorithm parameter strings and processes raw ECB mode, an attacker can cause memory corruption by selecting a cipher with a very large block size that overflows when converted to an integer, leading to undersized memory allocation. This could allow an attacker to corrupt memory and potentially achieve code execution in vulnerable applications.

Technologies: [Botan Project Botan](https://junglewise.ai/threats/technologies/botan). Vendors: [Botan Project](https://junglewise.ai/threats/vendors/botan-project).

## Quick answers

**Is CVE-2026-118769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118769 being exploited in the wild.

**How severe is CVE-2026-118769?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Botan Project Botan 2.1.0 to 3.12.x.

**Is there a fix for CVE-2026-118769?** Yes: fixed in Botan 3.13.0. Until then: Restrict access to algorithm parameter selection in applications using Botan's FFI; do not accept external algorithm specification strings when using raw ECB mode with block ciphers. Alternatively, disable or constrain use of variable-block-size ciphers like Cascade in security-sensitive deployments. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118769 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118769?** Check whether you run Botan Project Botan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Botan 3.13.0

Restrict access to algorithm parameter selection in applications using Botan's FFI; do not accept external algorithm specification strings when using raw ECB mode with block ciphers. Alternatively, disable or constrain use of variable-block-size ciphers like Cascade in security-sensitive deployments.

## Technical details

The botan_block_cipher_block_size FFI function converts a size_t block size to int without bounds checking, allowing integer overflow/truncation when very large block sizes (e.g., from Cascade cipher constructions) are used. An attacker exploiting this via external algorithm parameter strings and raw ECB mode can trigger memory corruption through undersized buffer allocation. The C++ API and typical C API modes (CBC, CTR) are unaffected; only raw ECB mode with variable-block-size ciphers is vulnerable.

## Affected products

- Botan Project Botan 2.1.0 to 3.12.x

## Timeline

- 2026-10-29: disclosed
- 2026-08-06: patched: Fix merged in PR #5805 with bounds checking added to botan_block_cipher_block_size

## References

- [https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3](https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3)
- [https://github.com/randombit/botan/pull/5805](https://github.com/randombit/botan/pull/5805)

## Related threats

- [Botan Scrypt integer overflow in memory calculation](https://junglewise.ai/threats/cve-2026-104267-botan-is-a-c-cryptography-library-from-2-7-0-until-3-13-0-botan)
- [Botan SSRF via HTTP redirect in OCSP client](https://junglewise.ai/threats/cve-2026-118766-botan-is-a-c-cryptography-library-prior-to-3-13-0-botan-s-online)
- [Botan TLS 1.3 client authentication bypass](https://junglewise.ai/threats/cve-2026-34582-botan-tls-1-3-client-authentication-bypass)
- [Botan certificate validation bypass in Certificate_Store](https://junglewise.ai/threats/cve-2026-34580-botan-certificate-validation-bypass-in-certificate-store)