Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-41509

Integer underflow in crypto_sign_open() leads to buffer overflow

Description

CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CROSS-signature CROSS-implementation

  • < fc6b7e78cdf789bb5c395a81dc601356f1383da0affected

References