CVE-2019-17362: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not p...

Security readout for executives and security teams

LibTomCrypt had a parsing flaw in DER-encoded UTF-8 handling through version 1.18.2. If a system processes attacker-supplied DER data, malformed input could crash the process or expose adjacent memory. Business urgency depends on whether LibTomCrypt is reachable through certificates, keys, or ASN.1/DER inputs. Exposure is most likely in applications, appliances, or embedded products using LibTomCrypt through 1.18.2 and decoding untrusted DER input. Inventory may be difficult because LibTomCrypt can be embedded as a library dependency. Treat as a targeted dependency remediation item, not an emergency by itself. Prioritize internet-facing or high-trust services that parse DER data, especially embedded products where library versions may lag. Mitigation focus: Identify direct and embedded LibTomCrypt usage through version 1.18.2.; Apply vendor or distribution security updates where available.; For source builds, review LibTomCrypt issue 507 and pull request 508 guidance..

Prepared

Jun 6, 2026, 13:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.