CVE-2026-41565
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers
In short
CryptX library for Perl has a vulnerability where certain decryption functions copy authentication tags into a buffer without checking their size, allowing attackers to overflow the stack and potentially crash the application or execute malicious code.
Technical detail
CWE-121 stack buffer overflow in AEAD decrypt_verify helpers (gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, eax_decrypt_verify) due to unchecked copying of caller-supplied authentication tags exceeding 144 bytes into a fixed-size stack buffer. Exploitation requires ability to supply oversized tags to affected decryption routines; impact includes stack corruption, denial of service, and potential code execution.
Summary generated and translated by AI from the official description.
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.
The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.
Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
MIK · CryptXWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →