Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by CPANSec

CVE-2026-41565CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers

High 7.5

In plain English

A high-severity stack buffer overflow in CryptX from MIK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three. Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcryptx-perlno fix listedDEBIAN-CVE-2026-41565
Debian:13libcryptx-perlno fix listedDEBIAN-CVE-2026-41565
Debian:14libcryptx-perl0.089-1DEBIAN-CVE-2026-41565
Ubuntu:25.10libcryptx-perlno fix listedUBUNTU-CVE-2026-41565
Ubuntu:26.04:LTSlibcryptx-perlno fix listedUBUNTU-CVE-2026-41565
Ubuntu:26.10libcryptx-perlno fix listedUBUNTU-CVE-2026-41565

Affected products (as reported)

VendorProductVersions
MIK CryptX 0 – before 0.088_001

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References