Read the docs
TI-2026-86145 Aliases CVE-2026-104267

Heap buffer overflow in Botan Scrypt on 32-bit platforms

Priority LOW 18CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Botan from 2.7.0 before 3.13.0 is affected. On 32-bit platforms, unchecked multiplication in its Scrypt memory sizing lets attacker-controlled parameters wrap the allocation, causing an out-of-bounds write (CWE-787). An attacker who supplies Scrypt parameters, such as in attacker-supplied encrypted private keys, can write about four gigabytes past a heap buffer, crashing the process. Arbitrary code execution is not demonstrated but cannot be excluded.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0.

Why it matters now

EPSS 0.00113 1st percentileScored 2026-11-07
Fix Fixed botan (randombit): 3.13.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
randombitbotan2.7.0 to before 3.13.03.13.0Patch availableCNA
  • botan Vendorrandombit Affected 2.7.0 to before 3.13.0 Fixed in 3.13.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*——randombit
  • cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:* Versions — — ·randombit

Remediation

Upgrade Botan to version 3.13.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA botan (randombit) Fixed in 3.13.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-104267

References

Other 3

  • TI-2024-33818 Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced… CVSS 3.1MEDIUM 5.9
  • TI-2024-33817 Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced… CVSS 3.1MEDIUM 5.9
  • TI-2016-02004 Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before… CVSS 3.0CRITICAL 9.8
  • TI-2016-02005 Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27… CVSS 3.0CRITICAL 9.8
  • TI-2026-26828 Botan has a certificate authentication bypass due to trust anchor confusion CVSS 4.0CRITICAL 9.3
  • TI-2016-07479 In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur… CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences