CVE-2023-26084

LOW 3.7CVE-2023-26084 · Published 15/03/2023 · updated 17/06/2026

In short

CVE-2023-26084 is a LOW (CVSS 3.7) vulnerability affecting aarch64cryptolib (arm).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 30.1% of all vulnerabilities.
Fix: update to 2023-02-20 or later.

Package	Affected versions	Patched versions
aarch64cryptolib arm	`< 2023-02-20`	`2023-02-20`

Description

The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable.

References

ARM-software/AArch64cryptolib security advisory · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free