Is CVE-2026-47738 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47738 being exploited in the wild.

How severe is CVE-2026-47738?

Medium severity, with a CVSS score of 5.3, published 6 November 2026.

Which products and versions are affected?

Open Quantum Safe Liboqs before 0.16.0.

How is CVE-2026-47738 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-47738?

Check whether you run Open Quantum Safe Liboqs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47738: liboqs uninitialized pointer dereference in NTRU KEM encaps_derand

CVE-2026-47738 · Severity: medium · CVSS 5.3 · Published 2026-11-06

liboqs is a cryptographic library implementing post-quantum cryptography algorithms. When an application calls the derandomized encapsulation function on one of six NTRU key encapsulation mechanisms, an uninitialized function pointer is dereferenced, causing the application to crash and resulting in a denial of service.

Technologies: Open Quantum Safe Liboqs. Vendors: Open Quantum Safe.

Quick answers

Is CVE-2026-47738 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47738 being exploited in the wild.
How severe is CVE-2026-47738?: Medium severity, with a CVSS score of 5.3, published 6 November 2026.
Which products and versions are affected?: Open Quantum Safe Liboqs before 0.16.0.
Is there a fix for CVE-2026-47738?: Yes: fixed in 0.16.0. Until then: Do not call OQS_KEM_encaps_derand on NTRU KEM instances, or ensure the application does not instantiate the affected NTRU variants (NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, NTRU-HRSS-1373) if derandomized encapsulation is required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47738 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-47738?: Check whether you run Open Quantum Safe Liboqs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.16.0

Do not call OQS_KEM_encaps_derand on NTRU KEM instances, or ensure the application does not instantiate the affected NTRU variants (NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, NTRU-HRSS-1373) if derandomized encapsulation is required.

Technical details

The six NTRU KEM constructors (hps2048509, hps2048677, hps4096821, hps40961229, hrss701, hrss1373) fail to initialize the encaps_derand function pointer in the OQS_KEM structure. When OQS_KEM_encaps_derand is invoked on these KEMs, the uninitialized heap value is dereferenced, causing a crash. An attacker can trigger this through network access if the application processes untrusted algorithm selections, or via local access if they can influence which KEM variant is instantiated.

Affected products

Open Quantum Safe liboqs before 0.16.0

Timeline

2026-11-06: disclosed
2026-06-12: patched: Fix merged in PR #2460

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.