CVE-2026-118769

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.

• CWE-125
• CWE-681
• CWE-787

• https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3
• https://github.com/randombit/botan/pull/5805
• https://github.com/randombit/botan/security/advisories/GHSA-c68p-822g-jfvr

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118763sigstore-js provides JavaScript libraries for interacting wi…7.4
• CVE-2026-118764minimatch is a minimal matching utility for converting glob …6.9
• CVE-2026-118765Botan is a C++ cryptography library. From 3.7.0 until 3.13.0…7.3
• CVE-2026-118766Botan is a C++ cryptography library. Prior to 3.13.0, Botan'…6.1
• CVE-2026-118767Botan is a C++ cryptography library. From 1.11.22 until 3.13…4.8
• CVE-2026-118768Botan is a C++ cryptography library. From 1.11.34 until 3.13…5.9
• CVE-2026-11877An unauthorized user can modify configuration through API ca…7.5
• CVE-2026-118772joi is a schema description language and data validator for …7.5
• CVE-2026-118773Glob matches files using patterns the shell uses. From 9.0.0…6.3
• CVE-2026-118774Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118775Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118776Forge (also called node-forge) is a native implementation of…3.7