CVE-2026-22023CWE-125

CryptoLib Has Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern

High · published January 10, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds heap read in CryptoLib could reveal sensitive information from memory, but only if you're using versions prior to 1.4.3. 🔐 Think of it like a space mission where the spacecraft's data is like a top-secret message that shouldn't be seen by prying eyes. This vulnerability is akin to a rogue signal pulling information from the communication line, potentially exposing confidential mission details! An attacker could exploit this vulnerability to read sensitive data from the heap memory, which may contain critical information about the spacecraft and its operations. This could lead to unauthorized access to mission secrets, putting the entire mission at risk.

Put simply

Think of it like a space mission where the spacecraft's data is like a top-secret message that shouldn't be seen by prying eyes. This vulnerability is akin to a rogue signal pulling information from the communication line, potentially exposing confidential mission details! This out-of-bounds heap read vulnerability in CryptoLib occurs in the cryptography_aead_encrypt() function, allowing attackers to access memory locations they shouldn't be able to, potentially exposing sensitive data.

What to do

An attacker could exploit this vulnerability to read sensitive data from the heap memory, which may contain critical information about the spacecraft and its operations. This could lead to unauthorized access to mission secrets, putting the entire mission at risk. To protect your communications, immediately update CryptoLib to version 1.4.3 or later. Review your current installation and ensure that all systems have been patched to mitigate this vulnerability effectively. You've got this! Stay vigilant and keep your systems secure! 🛡️

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00570 · 46.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-01-10T00:17Z
EPSS history
Timeline
  • 10 JAN 00:17Z
    CryptoLib Has Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern
    cvelistv5