// CVE · Published · NVD
Integer underflow of mlen in crypto_sign_open() in the CROSS reference implementation leads to a heap buffer overflow during signature verification.
The CROSS reference implementation, one of the additional post-quantum signature candidates in the NIST process, checked the message length in crypto_sign_open() in a way that could underflow. A signed message shorter than the signature envelope drove mlen below zero, and the following copy ran past the end of the output buffer. The scheme itself is not at fault: this is a coding error in the reference code that every downstream integration inherits.
Signature verification is the operation an attacker can always reach with untrusted input. A crafted signed message overflows the buffer during opening, which the GitHub advisory rates Critical (CWE-121, CWE-122) and NVD scores 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Credited in the advisory as iiviel (finder), Eva Crystal, XSource Security.
Insufficient protection of serialized SSL session/context data can lead to memory-safety issues when restoring tampered or corrupted state. Credited jointly with Haruto Kimura (Stella).
FFDH key exchange lacks contributory-behaviour / peer-key validation, enabling protocol-level abuse. Found independently by Eva Crystal (0xiviel).
Out-of-bounds read in mbedtls_ccm_finish(): an oversized tag_len in the multipart CCM API exposes adjacent CCM context data. Discovered through the Intigriti Trusted Firmware program.
Possible buffer overflow in mbedtls_ecdh_calc_secret() when the output buffer is too small - up to remote code execution.
