EUVD-2026-57758
GHSA-pfwq-9x97-jv4q
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector (AV:L) for timing channel; no privileges needed within local context (PR:N); high complexity (AC:H) due to oracle query volume and timing precision requirements; confidentiality-only impact.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.
AnalysisAI
RSA PKCS#1 v1.5 decryption in Oberon Microsystems AG's ocrypto library (versions 3.0.0 through 4.0.0) leaks padding validity through measurable timing differences, enabling Bleichenbacher-style padding oracle attacks that allow plaintext recovery. Affected systems must be running one of the vulnerable library versions and the attacker requires local access and the ability to submit multiple crafted decryption requests while capturing precise timing data. Vendor-released patch version 4.0.1 is available; no public exploit has been identified at time of analysis.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) identifies the root cause: the ocrypto library's RSA PKCS#1 v1.5 decryption path does not employ constant-time padding validation, so whether a ciphertext has valid padding is detectable via response-time differences. This is the classic Bleichenbacher '98 oracle class: an adversary submits many crafted ciphertexts and uses the timing signal as a binary oracle to iteratively recover the plaintext. RSA PKCS#1 v1.5 is widely known to be fragile against this attack when implementations are not carefully hardened. The affected product is identified by CPE cpe:2.3:a:oberon_microsystems_ag:ocrypto:*:*:*:*:*:*:*:* covering all 3.x releases up to (but not including) 4.0.1. The CVSS 4.0 vector (AV:L/AC:H/AT:P) reflects both the local measurement requirement and the specific attack prerequisites needed to conduct reliable timing analysis.
RemediationAI
Upgrade ocrypto to version 4.0.1 or later, as confirmed by the Oberon Microsystems AG security advisory at https://www.oberon.ch/security-advisories/cve-2026-16458/. If an immediate upgrade is not feasible, the most targeted compensating control is to replace RSA PKCS#1 v1.5 decryption with RSA-OAEP wherever the application permits - OAEP does not share the padding oracle weakness and is the current cryptographic standard for RSA encryption; the trade-off is potential compatibility breaks with legacy peers that only support PKCS#1 v1.5. A secondary control is to restrict local access to processes that can submit decryption requests or observe system timing, which raises the attacker's bar without eliminating the flaw. Generic network-layer controls (firewall rules, egress filtering) have no mitigating effect given the local attack vector.
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today