CVE-2026-53720

Katalog CVE

CVSS 5.1 · Medium EPSS 0,18%

Kerentanan Heap-based Buffer Overflow. Skor CVSS 4.0 5.1 (Medium) menurut github.com.

Deskripsi (NVD)

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8.

Rincian

Terbit di NVD

3 September 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 4.0

5.1 (Medium), sumber github.com
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write
CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86
• https://github.com/jetperch/pymonocypher/releases/tag/v4.0.2.8
• https://github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86