{"id":"CVE-2025-67897","title":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short","summary":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK pa…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-195"],"published":"2025-12-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67897","references":[{"url":"https://bugs.debian.org/1122582","label":"cve@mitre.org"},{"url":"https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","label":"cve@mitre.org"},{"url":"https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00354,"epssPercentile":0.27314,"ingestedAt":"2026-10-14T13:30:58.423Z","slug":"CVE-2025-67897","body":"## Overview\n\nIn Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}