# CVE-2026-32849: NetBSD signed integer overflow in cryptodev_op

Source: https://junglewise.ai/threats/cve-2026-32849-netbsd-signed-integer-overflow-in-cryptodev-op  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-32849 · Severity: medium · CVSS 5.5 · Published 2026-05-18

A vulnerability in the NetBSD kernel's cryptographic framework could allow a local user to crash the system. By providing specially crafted data to the system's encryption interface, an attacker can trigger a kernel panic, leading to a denial of service. This affects the stability and availability of the operating system but does not directly expose user data.

## Quick answers

**Is CVE-2026-32849 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32849 being exploited in the wild.

**How severe is CVE-2026-32849?** Medium severity, with a CVSS score of 5.5, published 18 May 2026.

**Which products and versions are affected?** NetBSD NetBSD prior to commit ec8451e.

**Is there a fix for CVE-2026-32849?** A patch was published on 2026-04-29: Fix committed to NetBSD source tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32849 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-32849?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signed integer overflow exists in sys/opencrypto/cryptodev.c within the cryptodev_op() function. The local variable 'iov_len' is declared as a signed integer but is assigned an unsigned value from 'cop->dst_len'. If a local attacker provides a 'dst_len' value exceeding INT_MAX via /dev/crypto (specifically using a compression session type), it triggers undefined behavior. This results in corrupted UIO pointer arithmetic and a subsequent NULL pointer dereference, causing a kernel panic. The issue is mitigated if CONFIG_SVS is enabled but remains exploitable in other configurations. A fix was introduced in commit ec8451e.

## Affected products

- NetBSD NetBSD prior to commit ec8451e

## Timeline

- 2026-02-06: disclosed: Vulnerability research published by nasm.re
- 2026-04-29: patched: Fix committed to NetBSD source tree
- 2026-05-18: advisory: CVE-2026-32849 published

## References

- [https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f](https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f)
- [https://nasm.re/posts/uaf_netbsd_crypto/](https://nasm.re/posts/uaf_netbsd_crypto/)
- [https://www.vulncheck.com/advisories/netbsd-signed-integer-overflow-in-cryptodev-op-via-cryptodev-c](https://www.vulncheck.com/advisories/netbsd-signed-integer-overflow-in-cryptodev-op-via-cryptodev-c)