liboqs CVE-2026-44518

liboqs (open-quantum-safe/liboqs, CPE cpe:2.3:a:open-quantum-safe:liboqs:*:*:*:*:*:*:*:*) is an open-source C library implementing post-quantum cryptographic algorithms, including stateful hash-based signature schemes. The affected code resides in src/sig_stfl/xmss/sig_stfl_xmss_xmssmt.c, which implements the OQS_SIG_STFL_verify entry point for XMSS and XMSS^MT - stateful signature schemes standardized as part of NIST SP 800-208. The root cause is CWE-20 (Improper Input Validation): the verification function accepted a caller-supplied signature_len parameter and immediately began consuming the buffer in a hash computation without first checking that signature_len met the expected size for the selected parameter set. Real XMSS signatures are kilobytes in length; a 10-byte buffer is sufficient to trigger the overread. The commit ef70dea7c85e5637f37828d75e5b9bb29dbfe513 corrects this by inserting a strict equality guard - if signature_len != expected_length, OQS_ERROR is returned immediately - and adds a regression test (test_invalid_sig) that exercises exactly this path with a 10-byte malicious signature buffer.