CVE-2016-6878: Botan Project Botan

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang.

Affected products

• Botan Project Botan: up to and including 1.11.30

Published 2017-04-10. Last modified 2026-06-17.