{"id":"CVE-2026-126792","kind":"vulnerability","aliases":["CVE-2026-126792"],"related":[],"title":"Key-management library: heap out-of-bounds write when embedder supplies crypto callbacks","description":"A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process.","summary":"A fixed-size output buffer in the library's key-management request-building code assumes a key size that is never checked, so oversized data can be written past the end of the heap buffer. The demonstrated result is memory corruption that crashes the client process, and an attacker must first be able to control the embedding application's key-provider configuration.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["custom-crypto-callbacks","embedded-crypto","key-management","other"],"not_affected_if":["default-config","no-custom-crypto-callbacks"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T00:20:12+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","triaged_at":"2026-11-13T00:41:21+00:00","updated_at":"2026-11-13T00:41:21+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-13T00:41:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Key-management library: heap out-of-bounds write when embedder supplies crypto callbacks","impact":"low","summary":"A fixed-size output buffer in the library's key-management request-building code assumes a key size that is never checked, so oversized data can be written past the end of the heap buffer. The demonstrated result is memory corruption that crashes the client process, and an attacker must first be able to control the embedding application's key-provider configuration.","audience":"developers","category":"other","nicknames":[],"who_cares":["key-management","embedded-crypto","custom-crypto-callbacks"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Memory corruption crashes the client process; code execution not demonstrated","analyst_note":"Identify the affected library from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-126792), then find its fixed version and whether any default configuration is exposed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-custom-crypto-callbacks"],"who_is_affected":"Applications that embed this library and supply their own cryptographic callback implementation are the ones the description covers. The attacker needs to control the in-process key-management provider configuration, which is a high-privilege position, so applications that do not use custom key providers are less exposed. The sources do not name the affected library, its versions or a fixed release.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4631,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126792':18A,21A '-2026':17A,20A 'abil':176C 'abl':87B 'abnorm':204C 'applic':92B,181C 'assum':49B 'assumpt':137C 'attack':83B 'bound':9A,122C 'buffer':37B,69B,132C,166C 'build':47B,110C 'callback':15A,25B,160C 'caller':154C 'check':56B 'client':79B,208C 'code':48B 'compon':111C 'configur':97B,190C 'control':89B,178C 'corrupt':75B,201C 'crash':77B 'crypto':14A,24B,28B 'cryptograph':139C,159C 'custom':23B 'custom-crypto-callback':22B 'cve':16A,19A 'data':59B,162C 'demonstr':71B,197C 'embed':27B,91B,151C,180C 'embedd':12A 'embedded-crypto':26B 'end':65B,172C 'exploit':173C 'first':85B 'fix':34B,129C 'fixed-s':33B,128C 'flaw':102C 'heap':5A,68B,126C 'high':193C 'high-privileg':192C 'impact':198C 'implement':161C 'in-process':183C 'key':2A,30B,43B,51B,95B,106C,140C,187C 'key-manag':1A,29B,42B,105C,186C 'key-provid':94B 'larger':163C 'lead':116C 'librari':4A,40B,114C,149C 'manag':3A,31B,44B,107C,188C 'memori':74B,100C,200C 'memory-safeti':99C 'must':84B 'never':55B,144C 'out-of-bound':6A,119C 'output':36B,131C 'overs':58B 'past':63B,170C 'posit':195C 'privileg':194C 'process':80B,185C,209C 'provid':96B,189C 'request':46B,109C 'request-build':45B,108C 'requir':174C 'result':72B,202C 'safeti':101C 'size':35B,52B,130C,141C 'suppli':13A,156C 'termin':205C 'use':134C 'valid':145C 'write':10A,123C 'written':62B,169C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed this library and supply their own cryptographic callback implementation are the ones the description covers. The attacker needs to control the in-process key-management provider configuration, which is a high-privilege position, so applications that do not use custom key providers are less exposed. The sources do not name the affected library, its versions or a fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["customcryptocallbacks","embeddedcrypto","keymanagement","medium","other"],"campaign_type":null,"search_a":"'-126792':18A,21A '-2026':17A,20A 'bound':9A 'callback':15A 'crypto':14A 'cve':16A,19A 'embedd':12A 'heap':5A 'key':2A 'key-manag':1A 'librari':4A 'manag':3A 'out-of-bound':6A 'suppli':13A 'write':10A","search_b":"'abl':87B 'applic':92B 'assum':49B 'attack':83B 'buffer':37B,69B 'build':47B 'callback':25B 'check':56B 'client':79B 'code':48B 'configur':97B 'control':89B 'corrupt':75B 'crash':77B 'crypto':24B,28B 'custom':23B 'custom-crypto-callback':22B 'data':59B 'demonstr':71B 'embed':27B,91B 'embedded-crypto':26B 'end':65B 'first':85B 'fix':34B 'fixed-s':33B 'heap':68B 'key':30B,43B,51B,95B 'key-manag':29B,42B 'key-provid':94B 'librari':40B 'manag':31B,44B 'memori':74B 'must':84B 'never':55B 'output':36B 'overs':58B 'past':63B 'process':80B 'provid':96B 'request':46B 'request-build':45B 'result':72B 'size':35B,52B 'written':62B","search_c":"'abil':176C 'abnorm':204C 'applic':181C 'assumpt':137C 'bound':122C 'buffer':132C,166C 'build':110C 'callback':160C 'caller':154C 'client':208C 'compon':111C 'configur':190C 'control':178C 'corrupt':201C 'cryptograph':139C,159C 'data':162C 'demonstr':197C 'embed':151C,180C 'end':172C 'exploit':173C 'fix':129C 'fixed-s':128C 'flaw':102C 'heap':126C 'high':193C 'high-privileg':192C 'impact':198C 'implement':161C 'in-process':183C 'key':106C,140C,187C 'key-manag':105C,186C 'larger':163C 'lead':116C 'librari':114C,149C 'manag':107C,188C 'memori':100C,200C 'memory-safeti':99C 'never':144C 'out-of-bound':119C 'output':131C 'past':170C 'posit':195C 'privileg':194C 'process':185C,209C 'provid':189C 'request':109C 'request-build':108C 'requir':174C 'result':202C 'safeti':101C 'size':130C,141C 'suppli':156C 'termin':205C 'use':134C 'valid':145C 'write':123C 'written':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:20:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126792","severity":null,"published_at":"2026-11-13T00:20:12+00:00","modified_at":"2026-11-13T00:20:12+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","fetched_at":"2026-11-13T00:41:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}