CVE-2025-13470

A flaw was found in RNP. This vulnerability allows for the trivial decryption of data encrypted using public-key encryption, fully compromising confidentiality, via an uninitialized symmetric session key in Public-Key Encrypted Session Key (PKESK) packets, which results in an all-zero byte array.

No Red Hat products or offerings are affected by this vulnerability.

This vulnerability is Important rather than Moderate because it completely undermines the fundamental security property of public-key encryption: the confidentiality of encrypted data. By leaving the PKESK session key uninitialized and effectively forcing it to an all-zero value, RNP 0.18.0 produces ciphertexts that can be decrypted by any attacker, without requiring the private key, without exploiting side channels, and without meeting any environmental preconditions. This is a direct cryptographic failure, not a partial weakness or a degraded security margin. The break is deterministic, universally exploitable, and affects all data encrypted through the affected PKESK path. As a result, encryption provides no protection whatsoever—equivalent to transmitting plaintext—making the impact complete and immediate confidentiality compromise. Vulnerabilities that convert strong encryption into trivially reversible encryption are categorically high-impact, not moderate, due to their total loss of security guarantees and zero attack complexity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.