CVE-2026-16458CWE-208CWE-327

CVE-2026-16458

published August 13, 2026

CVSS
5.9
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

The record
Technical detail
CVSS
5.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00091 · 0.5th percentile
Weaknesses
CWE-208 · Observable Timing Discrepancy; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-08-13T13:17Z
References (1)
https://www.oberon.ch/security-advisories/cve-2026-16458/ · [email protected]
EPSS history
Timeline
  • 13 AUG 08:31Z
    Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto
    cvelistv5