CVE-2026-41509 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-41509 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41509 is a critical buffer overflow vulnerability in the Cross-Crypto CROSS Implementation, affecting the reference and optimized implementations of the CROSS post-quantum signature algorithm, specifically within the signature verification function.

Technical Detail

The flaw exists in the crypto_sign_open() function, where insufficient bounds checking allows a buffer overflow condition to be triggered during signature verification. An attacker can supply a maliciously crafted signature or message input to overflow the buffer, potentially overwriting adjacent memory regions. Depending on the deployment context and memory layout, successful exploitation could lead to remote code execution, process corruption, or denial of service in any application that calls this verification routine.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in CISA's Known Exploited Vulnerabilities catalog. While the CVSS score of 9.8 reflects the theoretical severity of the flaw, there is currently no public proof-of-concept code or evidence of active exploitation in the wild.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given the post-quantum cryptography context, organizations evaluating or deploying CROSS-based signature schemes should treat this as a priority regardless of current attribution gaps.

What To Do

Update the CROSS Implementation to commit fc6b7e7 or any subsequent release that incorporates this fix, as this is the confirmed remediation point identified by the maintainers. Organizations that have integrated the CROSS library into applications or cryptographic toolchains should audit all call sites of crypto_sign_open() and rebuild affected binaries against the patched source. If an immediate update is not feasible, consider disabling or isolating any service that exposes signature verification to untrusted input until the patch can be applied. Monitor upstream repository activity and vendor advisories for additional guidance as this vulnerability is relatively newly disclosed.