CVE-2026-53720

Summary

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8.

Affected Software

VendorProductVersion RangeStatus
jetperchpymonocypher< 4.0.2.8affected

Weaknesses

  • CWE-122: CWE-122: Heap-based Buffer Overflow
  • CWE-787: CWE-787: Out-of-bounds Write
  • CWE-1284: CWE-1284: Improper Validation of Specified Quantity in Input

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References