Leancrypto EUVD-2026-18466

The leancrypto library is a post-quantum cryptography (PQC) library containing only quantum-resistant algorithms. The vulnerability resides in the lc_x509_extract_name_segment() function, which processes X.509 certificate Distinguished Name fields. The root cause is a type-casting vulnerability (CWE-681: Integer Overflow to Buffer Overflow) where the function casts a size_t variable representing the Common Name (CN) length to uint8_t when storing it. This creates a narrowing conversion: a size_t value of 256 + N bytes becomes (uint8_t)(256 + N) = N due to modulo 256 wrapping. By prepending a victim's CN with 256 bytes of padding in the attacker's certificate, the cn_size field truncates to match only the legitimate CN length, causing the parser to extract only the victim's identity bytes and discard the padding. This affects any code relying on leancrypto's X.509 parsing for certificate validation in PKCS#7 structures, certificate chain verification, and code signing applications.