CVE-2026-47738mediumCWE-824

CVE-2026-47738: medium-severity vulnerability in open-quantum-safe liboqs

liboqs: Uninitialized function-pointer dereference in OQS_KEM_encaps_derand for NTRU KEMs

Published

Follow this CVE+ Monitor liboqs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQS_KEM_encaps_derand can dereference an uninitialized encaps_derand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, or NTRU-HRSS-1373. The affected NTRU constructors omit the OQS_KEM.encaps_derand member because those schemes do not support derandomized encapsulation, OQS_KEM objects are allocated without zero initialization, and the wrapper in src/kem/kem.c checks only that the OQS_KEM pointer is non-null before calling through the residual heap value. An application is affected only if it instantiates one of those six NTRU KEMs and invokes OQS_KEM_encaps_derand on it. The supported impact is a calling-process crash and denial of service. This issue is fixed in version 0.16.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
open-quantum-safe · liboqs
Related CVEs — open-quantum-safe liboqs

In the same product, most dangerous first.

CVE-2024-36405MEDIUMControl-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other optionsEPSS 0.5%CVE-2024-54137HIGHliboqs has a correctness error in HQC decapsulationEPSS 0.4%CVE-2026-46344MEDIUMliboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194)EPSS 0.3%CVE-2026-44518MEDIUMliboqs: XMSS Buffer Overread BugEPSS 0.3%CVE-2025-48946LOWliboqs affected by theoretical design flaw in HQCEPSS 0.2%CVE-2025-52473MEDIUMliboqs secret-dependent branching in HQC reference implementation when compiled with Clang 17-20EPSS 0.2%