CVE Watch14 de out. de 2026

CVE-2022-2097

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under som

CVSS

5.3

Média

EPSS

4.9%

p92

KEV

—

Exploit Today

0-100

Publicado: 5 de jul. de 2022 · Última mod.: 14 de out. de 2026 · CWE-327

EPSS · 30d

4.9%EPSS · 30 dias4.9%

2026-10-172026-11-13

Descrição técnica

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-863535.0 MÉD

—

——0Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials.2d CVE-2026-1164137.1 ALT

—

——0Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access.2d CVE-2026-1135725.9 MÉD

45.5%

——14CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.3d CVE-2026-568988.4 ALT

3.6%

——1In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2d CVE-2026-1181025.9 MÉD

41.0%

——12Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.4d CVE-2026-1137636.3 MÉD

8.1%

——2Use of a broken or risky cryptographic algorithm in Windows DPAPI (Data Protection Application Programming Interface) allows an authorized attacker to elevate privileges locally.4d