p11-kit EUVD-2026-54413

Exploitation requires all three of the following: (1) the target system must be a 32-bit architecture - 64-bit systems are explicitly not vulnerable per the CVE description; (2) the attacker must have local access to the system or equivalent network-level access to a reachable p11-kit RPC channel socket; (3) the p11-kit RPC parsing process must be running and accepting connections. The CVSS vector PR:N indicates no privilege level is required once the attacker can reach the RPC channel. Limiting factors include: the overwhelming prevalence of 64-bit enterprise deployments which are unaffected; the p11-kit RPC daemon being an optional component that may not be active in all installations; and the impact being limited strictly to Denial of Service with no confidentiality or integrity compromise.

The CVSS 3.1 base score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a local-access, no-privilege DoS with no confidentiality or integrity impact. The most significant natural damper on real-world risk is the explicit 32-bit system requirement stated in the description - modern enterprise and cloud deployments are overwhelmingly 64-bit, sharply narrowing the exploitable population. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The vulnerability is not in the CISA KEV catalog, and no public exploit code has been identified, both of which suggest the threat is currently theoretical. The RPC channel attack surface slightly expands scope beyond purely local exploitation, but only if the p11-kit RPC daemon is exposed and reachable by an unprivileged peer - a configuration that itself requires deliberate setup. Overall, this is a low operational priority for organizations running 64-bit infrastructure, but warrants prompt patching on any 32-bit RHEL or OpenShift deployments where p11-kit is accessible.

An unprivileged local user on a 32-bit RHEL system sends a sequence of crafted RPC messages to the p11-kit daemon containing deeply nested PKCS#11 attribute structures with sizes chosen to trigger integer overflow during allocation. The daemon miscalculates the required heap buffer size, allocates an undersized region, and writes beyond its bounds, causing the p11-kit RPC process to crash and disrupting any application relying on PKCS#11 token access through that daemon. No public proof-of-concept code has been identified at time of analysis.