Vulnerability Details CVE-2026-41509
CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 26.6%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2026-41509
-
cpe:2.3:a:cross-crypto:cross-implementation:1.0
-
cpe:2.3:a:cross-crypto:cross-implementation:1.1
-
cpe:2.3:a:cross-crypto:cross-implementation:1.2
-
cpe:2.3:a:cross-crypto:cross-implementation:2.0
-
cpe:2.3:a:cross-crypto:cross-implementation:2.2