CVE-2016-2196: Botan Project Botan

Critical severity, CVSS 9.8. EPSS: 5.3% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (memory overwrite and crash) or execute arbitrary code via unspecified vectors.

Affected products

• Botan Project Botan: version 1.11.0 only; version 1.11.1 only; version 1.11.2 only; version 1.11.3 only; version 1.11.4 only; version 1.11.5 only; …

Published 2016-05-13. Last modified 2026-06-17.