Executive brief
liboqs is a software library used to implement next-generation 'post-quantum' cryptography. A flaw in how it verifies digital signatures could allow an attacker to provide a specially crafted public key that causes the software to crash. This results in a denial-of-service, potentially disrupting systems that rely on this library for secure communications or firmware updates.
Technical details
An out-of-bounds (OOB) read exists in the XMSS and XMSS^MT stateful signature verification implementation within liboqs. The vulnerability occurs because the verification wrappers fail to validate that the Object Identifier (OID) encoded in the first four bytes of a public key matches the expected algorithm's OID. When a mismatch occurs where the provided OID specifies a larger signature size than the actual buffer, the library uses the larger size to index the signature buffer during internal hash computations. This can result in a heap-based OOB read. While the data is not leaked to the caller, the read can cause a process crash if it accesses unmapped memory. The issue was fixed in version 0.16.0 by adding an OID consistency check at the API boundary.
Affected products
- Open Quantum Safe (OQS) liboqs < 0.16.0
Timeline
- 2026-05-15: advisory: GitHub Advisory GHSA-2wxh-55qf-c7wg published
- 2026-05-29: disclosed: CVE-2026-46344 published to NVD
- 2026-05-29: patched: Fix included in version 0.16.0