CVE-2026-118769

A flaw was found in Botan. An attacker can exploit an unchecked integer truncation in the C programming interface by supplying untrusted algorithm parameters that specify a variable-block-size cipher. This flaw causes the application to allocate an undersized memory buffer, resulting in heap memory corruption during data processing that may lead to arbitrary code execution or a denial of service (DoS).

A flaw was found in Botan's C API function botan_block_cipher_block_size(). When an application utilizing the C FFI raw ECB mode accepts untrusted external algorithm parameter strings, an attacker can specify the variable-block-size Lion cipher to trigger an unchecked integer truncation from size_t to int. This causes the application to allocate an undersized buffer, resulting in heap memory corruption during subsequent block processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Sanitize and restrict external algorithm parameter inputs using an allowlist to reject the variable-length Lion cipher when invoking Botan's C FFI interface. Alternatively, configure the application to utilize the native C++ API or standard cipher modes such as CBC or CTR instead of raw ECB mode.