CVE-2016-9132: In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause a...

Security readout for executives and security teams

Botan versions 1.8.0 through 1.11.33 can miscalculate a BER data length because of an integer overflow. In affected applications, an attacker-controlled length value could later trigger memory corruption or another failure, depending on how the application uses Botan’s returned value. Exposure is most likely in software that embeds or links Botan 1.8.0 through 1.11.33 and decodes BER data supplied by untrusted users, files, or network peers. Products are not enumerated in the source bundle. Treat as a targeted dependency remediation item. Prioritize internet-facing or file-processing services using affected Botan versions, but avoid emergency framing without evidence of active exploitation or a published severity score. Mitigation focus: Inventory applications and packages using Botan 1.8.0 through 1.11.33.; Apply vendor or distribution updates associated with CVE-2016-9132.; Review the upstream Botan commit and Fedora advisories for fix details..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.