Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

緊急 9.8CVE-2026-39892 · GHSA-p423-j2cm-9vmq · PYSEC-2026-36 · 08/04/2026 公開 · 10/09/2026 更新

要点

CVE-2026-39892 は cryptography, cryptography (cryptography.io) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.65%（全脆弱性の 51.3% より高い）。
対処：46.0.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
cryptography PyPI	`≥ 45.0.0, < 46.0.7`	`46.0.7`
cryptography cryptography.io	`≥ 45.0.0, < 46.0.7`	`46.0.7`

概要

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

NVD の説明

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.