# CVE-2026-34610: leancrypto integer truncation in lc_x509_extract_name_segment

Source: https://junglewise.ai/threats/cve-2026-34610-leancrypto-integer-truncation-in-lc-x509-extract-name-segment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34610 · Severity: medium · CVSS 5.9 · Published 2026-04-02

leancrypto is a cryptographic library used to provide post-quantum resistant security for digital signatures and certificates. A flaw in how the library processes digital certificates allows an attacker to create a fraudulent certificate that appears to belong to a legitimate user or organization. This could allow an attacker to impersonate a trusted entity, bypass security checks in code signing, or interfere with secure communications.

## Quick answers

**Is CVE-2026-34610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34610 being exploited in the wild.

**How severe is CVE-2026-34610?** Medium severity, with a CVSS score of 5.9, published 2 April 2026.

**Which products and versions are affected?** smuellerDD leancrypto < 1.7.1.

**Is there a fix for CVE-2026-34610?** A patch was published on 2026-03-30: Version 1.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34610?** Check whether you run Leancrypto. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer truncation vulnerability exists in the lc_x509_extract_name_segment() function of the leancrypto library. The function incorrectly casts a size_t value to a uint8_t when storing the length of a Common Name (CN) segment. By crafting a certificate with a CN containing specific padding (e.g., 256 bytes), an attacker can cause the stored length to wrap around, resulting in a parsed CN that matches a victim's identity. This enables identity impersonation during PKCS#7 verification, certificate chain matching, and code signing processes. The vulnerability is addressed in version 1.7.1 by using size_t for length storage and implementing proper bounds checking.

## Affected products

- smuellerDD leancrypto < 1.7.1

## Timeline

- 2026-03-30: patched: Version 1.7.1 released
- 2026-03-30: advisory: GitHub Security Advisory GHSA-636g-jxv4-v4gr published
- 2026-04-02: disclosed: CVE-2026-34610 published

## References

- [https://github.com/smuellerDD/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a](https://github.com/smuellerDD/leancrypto/commit/5cdcbe12bd6c3d6e87e969972a580b44a74c3a6a)
- [https://github.com/smuellerDD/leancrypto/releases/tag/v1.7.1](https://github.com/smuellerDD/leancrypto/releases/tag/v1.7.1)
- [https://github.com/smuellerDD/leancrypto/security/advisories/GHSA-636g-jxv4-v4gr](https://github.com/smuellerDD/leancrypto/security/advisories/GHSA-636g-jxv4-v4gr)