{"id":"CVE-2026-104267","kind":"vulnerability","aliases":["CVE-2026-104267"],"related":[],"title":"Botan: unchecked multiplication in Scrypt on 32-bit lets heap overflow","description":"Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.","summary":"Botan's Scrypt code on 32-bit platforms miscalculates buffer size from attacker-chosen parameters, so a crafted parameter set writes about four gigabytes past a heap buffer. The likely result is a crash (denial of service); code execution is described as difficult but not ruled out.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","botan","c++","cryptography","package"],"not_affected_if":["64-bit-only","scrypt-unused","trusted-scrypt-parameters"],"how_to_check":"- Check the Botan version in use, for example with `botan version` or the lockfile or package manifest, and look for anything from `2.7.0` up to `3.12.x`.\n- Check whether the application calls Scrypt and accepts Scrypt parameters from untrusted input, such as attacker-supplied encrypted private keys.\n- Confirm the build targets 32-bit platforms, since the flaw is limited to them.","fix":"- Botan `3.13.0`","status":"open","published_at":"2026-11-06T22:17:50+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","triaged_at":"2026-11-06T22:44:55+00:00","updated_at":"2026-11-06T22:44:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T22:44:55Z","model":"claude-haiku-5-5","output":{"fix":"- Botan `3.13.0`","reach":"network","title":"Botan: unchecked multiplication in Scrypt on 32-bit lets heap overflow","impact":"medium","summary":"Botan's Scrypt code on 32-bit platforms miscalculates buffer size from attacker-chosen parameters, so a crafted parameter set writes about four gigabytes past a heap buffer. The likely result is a crash (denial of service); code execution is described as difficult but not ruled out.","audience":"developers","category":"package","nicknames":[],"who_cares":["botan","c++","cryptography","32-bit"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Process crashes; code execution appears difficult but cannot be excluded","analyst_note":"","how_to_check":"- Check the Botan version in use, for example with `botan version` or the lockfile or package manifest, and look for anything from `2.7.0` up to `3.12.x`.\n- Check whether the application calls Scrypt and accepts Scrypt parameters from untrusted input, such as attacker-supplied encrypted private keys.\n- Confirm the build targets 32-bit platforms, since the flaw is limited to them.","plain_action":"","needs_analyst":false,"not_affected_if":["64-bit-only","trusted-scrypt-parameters","scrypt-unused"],"who_is_affected":"Only applications that use Botan's Scrypt on 32-bit platforms and accept Scrypt parameters from a hostile source, such as decrypting attacker-supplied encrypted keys. Systems that use Scrypt only with trusted parameters, or run on 64-bit platforms, are not exposed. unknown whether other paths are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4414,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104267':14A,17A '-2026':13A,16A '2.7.0':78C '3.13.0':80C,193C '32':7A,18B,29B,86C 'accept':124C 'affect':118C 'algorithm':113C 'alloc':104C,158C 'allow':95C 'appear':177C 'applic':132C 'approxim':147C 'arbitrari':125C,170C 'attack':37B,97C,136C 'attacker-chosen':36B 'attacker-control':96C 'attacker-suppli':135C 'bit':8A,19B,30B,87C 'botan':1A,20B,24B,71C,81C 'buffer':33B,52B,109C,160C 'c':21B,74C 'cannot':180C 'caus':146C,166C 'chosen':38B 'code':27B,62B,171C 'comput':89C 'control':98C 'craft':42B 'crash':58B,162C 'creat':107C 'cryptographi':22B,75C 'cve':12A,15A 'decrypt':134C 'demonstr':175C 'denial':59B,167C 'describ':65B 'difficult':67B,178C 'enabl':121C 'encrypt':138C 'exclud':182C 'execut':63B,172C 'fix':190C 'four':47B,148C 'gigabyt':48B,149C 'heap':10A,51B,159C 'hostil':129C 'immedi':161C 'implement':84C 'includ':131C 'issu':117C,188C 'key':140C 'let':9A 'librari':76C 'like':54B 'memori':91C 'miscalcul':32B 'multipl':3A,94C 'output':152C 'overflow':11A 'overwrit':185C 'packag':23B 'paramet':39B,43B,100C,126C,143C 'past':49B,156C 'platform':31B,88C 'primit':186C 'privat':139C 'process':164C 'requir':90C 'result':55B 'rule':70B 'scrypt':5A,26B,83C,99C,122C,151C 'servic':61B,169C 'set':44B,144C 'size':34B,105C 'smaller':110C 'sourc':130C 'subsequ':114C 'suppli':137C 'system':119C 'trigger':142C 'uncheck':2A,93C 'version':192C 'wrap':102C 'write':45B,115C 'written':155C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Botan's Scrypt on 32-bit platforms and accept Scrypt parameters from a hostile source, such as decrypting attacker-supplied encrypted keys. Systems that use Scrypt only with trusted parameters, or run on 64-bit platforms, are not exposed. unknown whether other paths are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["32bit","botan","c","cryptography","medium","package"],"campaign_type":null,"search_a":"'-104267':14A,17A '-2026':13A,16A '32':7A 'bit':8A 'botan':1A 'cve':12A,15A 'heap':10A 'let':9A 'multipl':3A 'overflow':11A 'scrypt':5A 'uncheck':2A","search_b":"'32':18B,29B 'attack':37B 'attacker-chosen':36B 'bit':19B,30B 'botan':20B,24B 'buffer':33B,52B 'c':21B 'chosen':38B 'code':27B,62B 'craft':42B 'crash':58B 'cryptographi':22B 'denial':59B 'describ':65B 'difficult':67B 'execut':63B 'four':47B 'gigabyt':48B 'heap':51B 'like':54B 'miscalcul':32B 'packag':23B 'paramet':39B,43B 'past':49B 'platform':31B 'result':55B 'rule':70B 'scrypt':26B 'servic':61B 'set':44B 'size':34B 'write':45B","search_c":"'2.7.0':78C '3.13.0':80C,193C '32':86C 'accept':124C 'affect':118C 'algorithm':113C 'alloc':104C,158C 'allow':95C 'appear':177C 'applic':132C 'approxim':147C 'arbitrari':125C,170C 'attack':97C,136C 'attacker-control':96C 'attacker-suppli':135C 'bit':87C 'botan':71C,81C 'buffer':109C,160C 'c':74C 'cannot':180C 'caus':146C,166C 'code':171C 'comput':89C 'control':98C 'crash':162C 'creat':107C 'cryptographi':75C 'decrypt':134C 'demonstr':175C 'denial':167C 'difficult':178C 'enabl':121C 'encrypt':138C 'exclud':182C 'execut':172C 'fix':190C 'four':148C 'gigabyt':149C 'heap':159C 'hostil':129C 'immedi':161C 'implement':84C 'includ':131C 'issu':117C,188C 'key':140C 'librari':76C 'memori':91C 'multipl':94C 'output':152C 'overwrit':185C 'paramet':100C,126C,143C 'past':156C 'platform':88C 'primit':186C 'privat':139C 'process':164C 'requir':90C 'scrypt':83C,99C,122C,151C 'servic':169C 'set':144C 'size':105C 'smaller':110C 'sourc':130C 'subsequ':114C 'suppli':137C 'system':119C 'trigger':142C 'uncheck':93C 'version':192C 'wrap':102C 'write':115C 'written':155C","first_public_at":"2026-09-01T22:08:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104267","severity":null,"published_at":"2026-11-06T22:17:50+00:00","modified_at":"2026-11-06T22:17:50+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","fetched_at":"2026-11-06T22:44:32+00:00","note":null}],"documents":[{"id":90728,"url":"https://github.com/randombit/botan/commit/459acdeba242dacc11ad8225e7d3e28203ce4f78","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90729,"url":"https://github.com/randombit/botan/security/advisories/GHSA-36rp-hhp4-wh83","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-01T22:08:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}