CVE-2016-7420

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-16 · updated 2026-06-17
Weakness: CWE-200

Description

Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintended in production use, which might allow context-dependent attackers to obtain sensitive information by leveraging access to process memory after an assertion failure, as demonstrated by reading a core dump.

Affected products

Cryptopp Crypto++: through 5.6.4

References

http://www.openwall.com/lists/oss-security/2016/09/15/12
http://www.openwall.com/lists/oss-security/2016/09/16/1
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/4
http://www.securityfocus.com/bid/92988
https://github.com/weidai11/cryptopp/commit/553049ba297d89d9e8fbf2204acb40a8a53f5cd6
https://github.com/weidai11/cryptopp/issues/277
http://www.openwall.com/lists/oss-security/2016/09/15/12
http://www.openwall.com/lists/oss-security/2016/09/16/1
http://www.openwall.com/lists/oss-security/2023/09/28/2
http://www.openwall.com/lists/oss-security/2023/09/28/4
http://www.openwall.com/lists/oss-security/2025/11/14/5

Get alerted when CVE-2016-7420 or the next vulnerability affects your stack