What’s Vulnerable › Vulnerabilities

CVE-2023-26084

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-15 · updated 2026-06-17
• Weakness: CWE-665

Description

The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable.

Affected products

• Arm Aarch64Cryptolib: before 2023-02-20 — fixed in 2023-02-20

How to fix

Upgrade to a fixed version: Arm Aarch64Cryptolib 2023-02-20. Check the vendor advisory for mitigations.

References

• https://github.com/ARM-software/AArch64cryptolib/security/advisories/GHSA-47c6-7x5x-r74g
• https://github.com/ARM-software/AArch64cryptolib/security/advisories/GHSA-47c6-7x5x-r74g

Get alerted when CVE-2023-26084 or the next vulnerability affects your stack