liboqs CVE-2026-46344

liboqs (CPE: cpe:2.3:a:open-quantum-safe:liboqs:*:*:*:*:*:*:*:*) is an open-source C library from the Open Quantum Safe project implementing post-quantum cryptography algorithms, including XMSS and XMSS^MT - stateful hash-based signature schemes. CWE-125 (Out-of-bounds Read) describes the root cause: within xmss_sign_open and xmssmt_sign_open, the implementation re-parses the XMSS parameter OID directly from the caller-supplied public key buffer (bytes pk[0..3]) rather than trusting the algorithm variant selected by the invoking wrapper. An adversary who supplies a public key with OID bytes pointing to a heavier parameter set - one with a larger sig_bytes value - causes the internal hash path in xmss_commons.c to index the caller-supplied signature buffer at an offset beyond its allocated length. Because the out-of-bounds bytes are consumed only as hash input and never returned to the caller, no memory-disclosure oracle is created. The fix in commit 077e32a adds an explicit OID consistency check in the verify wrapper, extracting the four-byte OID from the public key and comparing it against the OID hardcoded for the invoking algorithm variant before any internal re-parsing occurs; mismatches return OQS_ERROR immediately. This vulnerability is a sibling of CVE-2026-44518 (GHSA-wf7v-fhxj-73m2), which addresses a complementary OOB read triggered by an undersized signature buffer.