Executive brief
A vulnerability exists in pymonocypher, a Python wrapper for the Monocypher crypto library, specifically within its Argon2 password hashing implementation. If an application provides a buffer that is too small for the requested number of blocks, the library may write data past the end of that buffer. This could lead to application crashes or unpredictable behavior, potentially allowing an attacker with local access to corrupt system memory.
Technical details
A heap-based buffer overflow exists in pymonocypher's argon2i_32 implementation due to a lack of validation for the nb_blocks parameter relative to the provided buffer size. When a caller provides a buffer smaller than required by the API contract, the function performs an out-of-bounds write, leading to heap corruption. This is a local attack vector requiring the attacker to influence the parameters passed to the argon2i_32 function. The vulnerability is addressed in version 4.0.2.8 by adding explicit checks to ensure the buffer is large enough for the specified nb_blocks.
Affected products
- jetperch pymonocypher < 4.0.2.8
Timeline
- 2026-06-01: disclosed: Initial disclosure to vendor
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Fixed in version 4.0.2.8