CVE-2026-12340

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An out-of-bounds heap read occurs during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without verifying the key length. If a public key is shorter than 65 bytes, it triggers an out-of-bounds heap read, which can lead to a crash and result in a denial of service. This issue specifically affects builds configured with SM2 support via --enable-sm2 or --enable-all.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.