{"cve":"CVE-2025-67897","nvd":{"published":"2025-12-14T05:16:06.453","modified":"2026-10-14T13:10:00.187","status":"Deferred","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.3},"cwes":["CWE-195"],"references":["https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-67897","score":0.00354,"percentile":0.2886,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-v6x3-9r38-r27q","url":"https://osv.dev/vulnerability/GHSA-v6x3-9r38-r27q","summary":"Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short","modified":"2026-09-10T03:50:32.193634287Z","packages":[{"ecosystem":"crates.io","name":"sequoia-openpgp","purl":"pkg:cargo/sequoia-openpgp","ranges":["<2.1.0"],"fixed":["2.1.0"]}]},{"id":"RUSTSEC-2025-0136","url":"https://osv.dev/vulnerability/RUSTSEC-2025-0136","summary":"Underflow in aes_key_unwrap function","modified":"2025-12-17T06:16:23.047289Z","packages":[{"ecosystem":"crates.io","name":"sequoia-openpgp","purl":"pkg:cargo/sequoia-openpgp","ranges":[">=0.0.0-0 <2.1.0"],"fixed":["2.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}