Botan EUVD-2026-113278

Three concrete prerequisites must all hold: (1) the application accepts arbitrary/external algorithm-parameter strings from untrusted parties; (2) it uses Botan's FFI (C API) raw ECB-mode block-cipher interface and trusts the botan_block_cipher_block_size return value to size a buffer; and (3) the attacker names the variable-block-size Lion cipher (directly or inside a Cascade) with a block size large enough to overflow int. Limiting factors that sharply narrow real-world exposure: the C++ API is entirely unaffected, and the standard FFI cipher modes CBC and CTR are unaffected - only the raw ECB block-cipher FFI path is vulnerable, and only when externally controlled algorithm names are permitted. Vendor-stated workaround: allow only specific known fixed-size block ciphers and reject any externally supplied algorithm name containing the substring 'Lion'; the complete fix is upgrading to 3.13.0.

The signals here conflict sharply and that conflict is the headline. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 (Critical) and the vuln.today decision label is act_now, yet the vendor's own GHSA advisory explicitly assigns LOW severity, stating the limited exploitation path is the reason. Both can be reconciled: the AT:P (attack-requirement present) metric and the vendor's reasoning point to the same narrow precondition - the vulnerability is only reachable in an application that (a) accepts arbitrary algorithm-parameter strings from untrusted parties AND (b) drives Botan's FFI/C API raw ECB-mode block-cipher interface. The C++ API and the normally used C API modes (CBC, CTR) are unaffected. So the high base score reflects worst-case impact (memory corruption → potential high confidentiality/integrity/availability loss) against a configuration that is uncommon, not a broadly exploitable default. This is NOT in CISA KEV (not listed in the input), so there is no confirmed active exploitation, and EPSS is not provided in the input, so the exploitation-probability signal is MISSING and cannot be weighed. No working exploit reference is supplied; however, the fix's own test case and the advisory disclose a concrete trigger string (e.g. 'Cascade(Lion(SHA-256,ChaCha20,977022),Lion(SHA-256,ChaCha20,1006679))'), which lowers the research bar considerably. Net: treat as a genuine priority for the specific population of applications that expose Botan's FFI raw-ECB interface to attacker-chosen algorithm names; for everyone else (C++ API, standard modes) real-world risk is low despite the Critical score. The act_now label should be read as 'patch promptly where the FFI/ECB path is exposed,' not 'mass exploitation imminent.'

An application exposes Botan's FFI raw ECB block-cipher interface and lets an external party supply the algorithm name. The attacker supplies the variable-block-size Lion cipher (or a Cascade of Lions) whose block size exceeds INT_MAX; botan_block_cipher_block_size truncates the size_t to a small or negative int, the application allocates an undersized buffer based on that value, and subsequent block processing writes past it, corrupting memory. No public weaponized exploit is identified at time of analysis, though the patch's regression test publishes a concrete triggering algorithm string.