SECURITY ANNOUNCEMENT

CVE-2026-99037

23 October 2026

check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because the IV constructor runs after crypt_set_key. Note that this is not a security bug because the memory corruption can

Introduced

4.1233d2f09fcb357fd1861c4959d1d3505492bf91f8

Fixed releases

6.12.113962ce265fbf5d87afeb78cf19c12e083ab0ffeb8

6.18.57a1a875614dae43b43d311bb9e7a7a70eed78efe6

6.6.1609a0dab8a9d9975dec14a118b55cae2517aea5ca9

7.2.1140ea7dfa8cd5f9aed72a55c9ca3008aee5880e6f

7.33195e0daf590683992edb4eed32269e569e04924

View source announcement ↗