EUVD-2026-70531
GHSA-8f95-v3jq-cj86
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector since exploitation occurs via library API call; high complexity because undersized nb_blocks must be supplied; scope changed due to heap corruption potentially affecting surrounding process memory beyond the function.
Primary rating from Vendor (https://github.com/jetperch/pymonocypher).
CVSS VectorVendor: https://github.com/jetperch/pymonocypher
Lifecycle Timeline
2DescriptionCVE.org
Impact
The argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap.
Patches
Fixed in 4.0.2.8, which now verifies that nb_blocks is large enough. See 90ff5b1.
Workarounds
Provide a correctly sized nb_blocks buffer.
pymonocypher thanks Haris (hextheshadow) for the vulnerability report, details, and recommended fix.
AnalysisAI
Heap buffer overflow in pymonocypher's argon2i_32 function allows memory corruption when callers supply an undersized nb_blocks buffer, violating the library's API contract without triggering any bounds check. Applications using pymonocypher prior to version 4.0.2.8 that invoke the Argon2i password-hashing interface are at risk of heap corruption, which can produce crashes or potentially enable controlled memory writes. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
Technical ContextAI
pymonocypher is a Python wrapper (pip package) for the Monocypher C cryptographic library, exposing bindings for algorithms including Argon2i - a memory-hard password-hashing and key-derivation function standardized in RFC 9106. The argon2i_32 binding accepts an nb_blocks parameter that governs the size of the working memory buffer allocated by the caller. CWE-122 (Heap-Based Buffer Overflow) identifies the root cause: the function proceeds to write into the caller-supplied buffer without first verifying that nb_blocks meets the minimum size required by the algorithm, allowing writes beyond the heap allocation boundary. The upstream fix, committed at 90ff5b13b13b5673c372e188f482d8c172e6ab86, introduces an explicit size validation gate before any memory operation proceeds. The affected CPE is pkg:pip/pymonocypher.
RemediationAI
Upgrade pymonocypher to version 4.0.2.8 or later; this release adds nb_blocks size validation in argon2i_32 and is the primary fix. The patching commit is available at https://github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86 and the full advisory at https://github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86. If immediate upgrade is not feasible, the vendor-recommended workaround is to audit every call site of argon2i_32 and ensure the nb_blocks buffer is correctly sized per the documented API contract before each invocation. Note that this workaround requires code-level review and is error-prone; it does not prevent the vulnerability in third-party or transitive callers and should not be treated as a permanent substitute for patching.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today