Home / mailings [USN-8686-1] openCryptoki vulnerabilities
Posted on 27 August 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8686-1
August 27, 2026
opencryptoki vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in openCryptoki.
Software Description:
- opencryptoki: A PKCS#11 Cryptographic Token Interface Standard implementation.
Details:
It was discovered that primitive decoders in openCryptoki produced integer
underflows when the encoded length was zero. An attacker could possibly use
this issue to trigger out-of-bounds reads. (CVE-2026-40253)
It was discovered that openCryptoki incorrectly handled symlinks. An
attacker in the token-group could possibly use this issue to achieve
privilege escalation or access sensitive information. (CVE-2026-23893)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libopencryptoki-dev 3.23.0+dfsg-0ubuntu3.1
libopencryptoki0 3.23.0+dfsg-0ubuntu3.1
opencryptoki 3.23.0+dfsg-0ubuntu3.1
Ubuntu 22.04 LTS
libopencryptoki-dev 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3
libopencryptoki0 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3
opencryptoki 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8686-1
CVE-2026-23893, CVE-2026-40253
Package Information:
https://launchpad.net/ubuntu/+source/opencryptoki/3.23.0+dfsg-0ubuntu3.1
https://launchpad.net/ubuntu/+source/opencryptoki/3.17.0+dfsg+20220202.b40982e-0ubuntu1.3
--===============4315455007527129835==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
