VULNERABILITY INTELLIGENCE

CVE-2026-2100

CVSS score5.3 MEDIUM
EPSS probability1.31%
CISA KEVNot currently listed
Published2026-03-26
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Weakness classification

  • secalert@redhat.com: CWE-824

Primary references