openCryptoki EUVD-2026-23318

openCryptoki implements the PKCS#11 cryptographic token interface standard for Linux and AIX, providing a shared library layer used by applications to interact with hardware security modules (HSMs) and software tokens. The vulnerable code is in usr/lib/common/asn1.c, which handles BER/DER (Basic Encoding Rules / Distinguished Encoding Rules) parsing for ASN.1-structured cryptographic objects such as keys and certificates. The root cause (CWE-125, Out-of-bounds Read) is that five decoder functions - ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE - accept a raw byte pointer with no corresponding buffer-length argument, so they trust the attacker-supplied BER length octets to determine how many bytes to read. The commit diff confirms the fix pattern: each function signature gained a CK_ULONG buffer-length parameter and now validates that 1 + tag + length + value does not exceed the supplied bound before dereferencing. A secondary variant exists in ber_decode_INTEGER where a zero-length encoding causes an integer underflow. Because asn1.c is the shared common library, all six token backends - Soft, ICA, CCA, TPM, EP11, and ICSF - inherit the flaw.