Description

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-07T09:16:58.670Z",
  "pubdate": "2026-08-07T09:16:58.670Z",
  "executiveSummary": "An integer overflow vulnerability has been identified in p11-kit, specifically residing within its RPC parsing functionality. This flaw allows a local attacker, or an adversary with equivalent access to a reachable RPC channel, to compromise the integrity and availability of the affected system.\nThe vulnerability stems from an incorrect calculation of memory allocation sizes when handling nested attributes within specially crafted RPC messages. Upon processing these malicious messages, the application suffers a memory corruption issue characterized by a heap out-of-bounds write.\nThe primary impact of this vulnerability is a Denial of Service (DoS), as the memory corruption reliably triggers a crash of the p11-kit RPC parsing process. Exploitation of this flaw is strictly limited to 32-bit systems, where integer bounds make the arithmetic overflow condition achievable.\nAttackers require local access or reachability to the RPC channel to transmit the malicious payload. While arbitrary code execution cannot be definitively ruled out by the memory corruption primitive alone, the documented and guaranteed impact is the termination of the parsing process, causing service disruption for applications relying on p11-kit for cryptographic token management.",
  "technicalDetails": "The vulnerability is rooted in the p11-kit RPC parsing mechanism, specifically in how the codebase processes and allocates memory for nested attributes. When parsing incoming RPC messages containing nested structures, the software performs arithmetic operations to determine the total memory size required for allocation.\nDue to a lack of proper bounds checking and overflow validation prior to the allocation routine, an attacker can supply specially crafted inputs designed to cause an integer overflow during this size calculation. On 32-bit systems, the restricted address space and integer register sizes facilitate the wrapping of integer values.\nOnce the integer wraps, the resulting allocation size passed to the memory management subsystem is significantly smaller than the actual size required to hold the incoming nested attributes. Consequently, when the application attempts to copy or write the parsed data into the undersized buffer, a heap out-of-bounds write occurs.\nThe step-by-step attack flow proceeds as follows: First, the attacker establishes communication with the p11-kit RPC channel, either locally or via a reachable network/inter-process communication pathway. Second, the attacker formulates and transmits a specially crafted RPC message containing deeply nested attributes engineered to trigger the integer overflow during size evaluation. Third, p11-kit calculates the truncated memory allocation size based on the overflowed integer. Fourth, the heap allocation is provisioned with insufficient capacity. Fifth, during the deserialization and copying phase, the out-of-bounds write corrupts adjacent heap metadata or memory structures. Finally, the resulting heap corruption destabilizes the runtime environment, causing the p11-kit RPC parsing process to crash and resulting in a Denial of Service.\nThe vulnerable component is the p11-kit RPC message parser. The prerequisites for exploitation include targeting a 32-bit system architecture and having access to the p11-kit RPC channel. Authentication requirements depend on the exposure and access control configuration of the specific RPC channel in use."
}