EUVD-2026-57756
GHSA-f34q-f47h-v25c
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and high complexity reflect timing measurement requirements; no privileges needed to query the API; only confidentiality is impacted via plaintext recovery.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.
AnalysisAI
Timing-based padding oracle attack in Oberon Microsystems AG's Oberon PSA Crypto library (versions 1.0.0 through 2.1.0) enables plaintext recovery from RSA PKCS#1 v1.5-encrypted ciphertext. An attacker capable of submitting decryption requests and measuring response timing can exploit observable timing discrepancies during padding validation - a Bleichenbacher-class attack - to iteratively deduce encrypted data. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the confidentiality impact is rated High as successful exploitation yields full plaintext recovery.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) describes flaws where the duration of a cryptographic operation leaks secret-dependent information. In RSA PKCS#1 v1.5 decryption, valid and invalid padding conditions should be processed in constant time; if they are not, an attacker can distinguish outcomes via timing, enabling a Bleichenbacher 1998-style adaptive chosen-ciphertext attack. The affected product is the Oberon PSA Crypto library (CPE: cpe:2.3:a:oberon_microsystems_ag:oberon_psa_crypto:*:*:*:*:*:*:*:*), which implements the ARM Platform Security Architecture (PSA) Cryptography API, commonly embedded in IoT, microcontroller, and constrained-device firmware stacks. The CVSS 4.0 vector (AV:L/AC:H/AT:P) confirms the attack requires local or proximate access with specific preconditions and high complexity, consistent with the need for hundreds of thousands of precise timing measurements.
RemediationAI
Vendor-released patch: version 2.1.1. Upgrade the Oberon PSA Crypto library to version 2.1.1 or later, as confirmed by the vendor advisory at https://www.oberon.ch/security-advisories/cve-2026-16459/. For embedded or firmware-based deployments where an immediate library update is not feasible, a targeted compensating control is to migrate RSA decryption operations from PKCS#1 v1.5 padding to RSA-OAEP, which does not exhibit the same padding-oracle timing surface - note this requires corresponding changes to the encryption side and may not be backward-compatible with existing protocol implementations. Alternatively, restricting who or what can submit decryption oracle queries (e.g., limiting the API surface exposed to untrusted callers, enforcing request rate limits) reduces the attacker's ability to gather the volume of timing measurements needed for successful exploitation. Generic 'defense in depth' without the above specific mitigations is insufficient given the direct timing leak in the library itself.
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today