VULNERABILITY INTELLIGENCE

CVE-2016-9132

CVSS score9.8 CRITICAL
EPSS probability2.32%
CISA KEVNot currently listed
Published2017-01-30
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.

Weakness classification

  • CWE-190: Integer Overflow or Wraparound

Primary references