Executive brief
The CROSS implementation, which provides post-quantum cryptographic signature algorithms, contains a critical security flaw. An attacker could exploit this vulnerability to cause a system crash or potentially execute unauthorized code by providing a specially crafted signature. This could compromise the integrity and availability of systems relying on this library for secure digital signatures.
Technical details
A buffer overflow vulnerability exists in the `crypto_sign_open()` function of the CROSS reference and optimized implementations. The root cause is an integer underflow of the `mlen` (message length) variable when the signed message length (`smlen`) is smaller than the expected signature size (`sizeof(CROSS_sig_t)`). This underflow results in a very large value being used for subsequent memory operations, leading to stack or heap-based buffer overflows. An attacker can trigger this by providing a truncated or malformed signature over the network. The issue was addressed in commit fc6b7e7 by adding a bounds check to ensure `smlen` is at least the size of a valid signature.
Affected products
- CROSS-signature CROSS-implementation Prior to commit fc6b7e7
Timeline
- 2026-03-07: other: Vulnerability reported to liboqs by iiviel
- 2026-03-23: patched: Fix committed to repository (commit fc6b7e7)
- 2026-03-24: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD