Botan CVE-2026-32877

Botan versions 2.3.0 through 3.10.x with SM2 cryptography enabled. Remote unauthenticated attacker sends crafted SM2-encrypted ciphertext. Application must attempt SM2 decryption on attacker-controlled input. No user interaction required.

Real-world risk is moderate-to-high for systems processing untrusted SM2 ciphertexts, though practical exploitation complexity tempers immediate urgency. The CVSS 8.2 score reflects legitimate concerns: network-accessible attack vector (AV:N), low complexity (AC:L), no authentication required (PR:N), and high availability impact (A:H) from denial-of-service potential. However, the confidentiality impact is rated only Low (C:L), as the 31-byte over-read may expose limited heap data but does not guarantee extraction of sensitive cryptographic material. Without EPSS data, we assess exploitation likelihood as moderate - the vulnerability requires attackers to craft malformed SM2 ciphertexts and target systems actively using Botan's SM2 implementation, which has more limited deployment than mainstream algorithms like RSA or AES. No CISA KEV listing and no public exploit identified at time of analysis suggest this is not yet widely targeted. Primary risk scenarios include: (1) denial-of-service against SM2-enabled services through repeated malformed ciphertext submissions causing crashes; (2) potential information disclosure if heap layout is predictable and adjacent memory contains secrets; (3) undefined behavior exploitation in memory-unsafe contexts. Organizations using Botan for SM2 operations, particularly in Chinese regulatory environments requiring SM2 compliance, should prioritize patching. Systems not using SM2 functionality remain unaffected despite running vulnerable Botan versions.

An attacker identifies a cloud-based document encryption service using Botan 3.10.x with SM2 for Chinese market compliance. The attacker crafts a malicious SM2 ciphertext with a truncated C3 authentication tag and submits it through the service's decryption API. When Botan attempts to validate the authentication code, the missing length check triggers a heap over-read, causing the service process to crash and denying legitimate users access to decryption functionality. By repeatedly submitting crafted payloads during peak hours, the attacker sustains a denial-of-service condition. In a more sophisticated scenario, the attacker analyzes crash dumps or timing variations to infer adjacent heap memory contents, potentially leaking cryptographic key material or session tokens if memory layout is predictable.