---
id: "CVE-2026-126792"
page: "https://infrastack.ai/live/CVE-2026-126792"
kind: "vulnerability"
aliases: ["CVE-2026-126792"]
title: "Key-management library: heap out-of-bounds write when embedder supplies crypto callbacks"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["custom-crypto-callbacks", "embedded-crypto", "key-management", "other"]
not_affected_if: ["default-config", "no-custom-crypto-callbacks"]
published_at: "2026-11-13T00:20:12+00:00"
first_seen_at: "2026-11-13T00:41:06+00:00"
updated_at: "2026-11-13T00:41:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126792", "first_seen_at": "2026-11-13T00:41:06+00:00"}]
exploit_sources: []
---

# Key-management library: heap out-of-bounds write when embedder supplies crypto callbacks

Link for people: https://infrastack.ai/live/CVE-2026-126792 (this .md is for agents)

A fixed-size output buffer in the library's key-management request-building code assumes a key size that is never checked, so oversized data can be written past the end of the heap buffer. The demonstrated result is memory corruption that crashes the client process, and an attacker must first be able to control the embedding application's key-provider configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-13T00:41:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126792

## From the sources

A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that supplies its own cryptographic callback implementation, data larger than the buffer can be written past its end. Exploitation requires the ability to control the embedding application's in-process key-management provider configuration, a high-privilege position. The demonstrated impact is memory corruption resulting in abnormal termination of the client process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_