External risk intelligence

Botan C API Integer Truncation Vulnerability Leads to Memory Corruption.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-118769

Botan is a cryptography library, not a standalone network service or appliance. Exploitation requires an application to specifically use the affected C API function with external input in a niche FFI raw ECB configuration. While library functions can be part of internet-facing applications, they are typically embedded components rather than public-facing services, making direct internet exposure uncommon.

Out-of-bounds Read

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Botan cryptography library, a component used in various software applications. The issue could allow an attacker to cause memory corruption by manipulating block cipher parameters, potentially impacting systems that use a specific, less common configuration of the library's C API.

Library flaw allows memory corruption via incorrect size handling.
Matters if your apps use specific C API configurations.
Confirm relevance; ensure no external parameter manipulation.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing specially crafted algorithm parameter strings to an application using the Botan C API. This would involve selecting the variable-block-size Lion cipher through the FFI raw ECB mode. When the application attempts to process the block size, it may allocate insufficient memory, leading to memory corruption during subsequent operations.

Requires application use of specific C API.
Triggered by external algorithm parameter strings.
Can lead to memory corruption.

Live Threat

Current exploitation, exposure, and threat context

An attacker could trigger memory corruption when an application improperly handles external algorithm parameters and uses the affected C API function with the Lion cipher in raw ECB mode. This specific configuration is not part of the C++ API or common C API modes like CBC and CTR.

Application memory corruption.
Unchecked block size conversion.
Service instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Botan library's vulnerability necessitates a multi-team response, likely involving application owners who integrate the library, platform teams managing its deployment, and security teams assessing overall risk. The initial step is to identify all applications using Botan, focusing on those exposed to external input via the affected C API and FFI raw ECB mode. Once identified, confirm business criticality and then coordinate remediation with the accountable application owner, prioritizing systems with the highest exposure.

Application owners should own the issue.
Verify external C API and FFI raw ECB usage.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Botan and why do developers use it?

Botan is a C++ library that provides developers with building blocks for cryptography, such as encryption algorithms and message authentication. It acts as an underlying engine for applications that need to secure data. Because it offers both C++ and C interfaces, it is often embedded within larger software suites to handle sensitive cryptographic operations efficiently.

How does this CVE-2026-118769 memory corruption occur?

The issue involves an integer conversion weakness (CWE-681) in the Botan C API. When the library processes a block size, it incorrectly converts a large number into a smaller integer type. If an attacker chooses the Lion cipher, this truncation causes the application to underestimate the required memory. When the library later writes data into that undersized buffer, it leads to memory corruption.

Does any input to the library trigger this flaw?

No. The vulnerability only triggers when an application allows external, untrusted input to control algorithm parameters and specifically uses the FFI raw ECB mode. Configurations using the C++ API or standard C API modes—such as CBC or CTR—are not affected by this specific truncation bug.

Is my software relevant to CVE-2026-118769?

Halo Surface Signal notes that since Botan is an embedded library rather than a standalone network service, direct internet exposure is uncommon. You should focus on applications that pass external user input directly into Botan's raw ECB C API. If your software does not use this specific, niche interface, it is likely not impacted by this threat.

What is the first step to address this library issue?

Your priority is to audit your application codebase to identify where the Botan library is integrated. Specifically, check if any components accept external parameter strings and utilize the C API's FFI raw ECB mode. Once you map these specific implementation points, you can confirm whether those modules are reachable by external actors and plan to update the library to version 3.13.0.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.