CVE-2026-41509

Description

CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 6.9 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Effective score: 6.9 / 10 MEDIUM source: CNA overview
CWE(s): CWE-121, CWE-122
Reserved: 2026-04-20
Published: 2026-05-08 13:47 UTC
Last updated: 2026-05-08 14:15 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41509.json
Linked Threat: CVE-2026-41509 — CVE-2026-41509

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-08 14:16:34 UTC
NVD last modified: 2026-05-12 14:15:13 UTC
NVD CVSS v3.1: 9.8 / 10 CRITICAL source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0006 (probability of exploitation in next 30 days)
EPSS percentile: 18.82% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28598
Assigner: GitHub_M
Published: May 8, 2026, 1:47:17 PM
Updated: May 8, 2026, 2:15:21 PM
EUVD base score (CVSS 4.0): 6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0600
Vendors: CROSS-signature
Products: CROSS-implementation (< fc6b7e78cdf789bb5c395a81dc601356f1383da0)

ENISA description: CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
CROSS-signature	CROSS-implementation	`< fc6b7e78cdf789bb5c395a81dc601356f1383da0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:cross-crypto:cross-implementation:*:*:*:*:*:*:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/CROSS-signature/CROSS-implementation/security/advisories/GHSA-w72c-hgx8-p7cv x_refsource_CONFIRM
https://github.com/CROSS-signature/CROSS-implementation/commit/fc6b7e78cdf789bb5c395a81dc601356f1383da0 x_refsource_MISC

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://github.com/CROSS-signature/CROSS-implementation/commit/fc6b7e78cdf789bb5c395a81dc601356f1383da0 tenable:github.com
https://github.com/CROSS-signature/CROSS-implementation/security/advisories/GHSA-w72c-hgx8-p7cv tenable:github.com
https://nvd.nist.gov/vuln/detail/CVE-2026-41509 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-41509 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/CROSS-signature/CROSS-implementation/commit/fc6b7e78cdf789bb5c395a81dc601356f1383da0 security-advisories@github.com Patch
https://github.com/CROSS-signature/CROSS-implementation/security/advisories/GHSA-w72c-hgx8-p7cv security-advisories@github.com Vendor Advisory

Remediations (12)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

2026-05-23 21:53 UTC
CVE-2026-21509: Microsoft Office Zero-Day Active Exploit | Orca Security

web:orca.security

Microsoft patches CVE - 2026 -21509, a high-severity Office zero-day actively exploited in the wild. Learn about the OLE bypass, affected versions, and remediation .

2026-05-23 21:53 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:53 UTC
Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for ...

web:thehackernews.com

Microsoft released out-of-band patches for an actively exploited Microsoft Office zero-day, CVE - 2026 -21509, a security feature bypass flaw.

2026-05-23 21:53 UTC
Microsoft patches actively exploited Office zero-day vulnerability

web:www.bleepingcomputer.com

Microsoft has released emergency security updates to patch a high-severity Office zero-day vulnerability exploited in attacks.

2026-05-23 21:53 UTC
CVE-2026-21509 - How a Microsoft Office Bug Lets Attackers Bypass ...

web:www.cve.news

In early 2026 , a new vulnerability was disclosed affecting Microsoft Office, tagged as CVE - 2026 -21509. This bug highlights how relying on untrusted user input can open the gates for attackers to slip past built-in security features—right from your favorite Word or Excel application. In this deep dive, I'll break

2026-05-23 21:53 UTC
Emergency patch issued for Microsoft Office, 365 over hacking threat - MSN

web:www.msn.com

Original story: Microsoft has released an emergency patch for a vulnerability in the company's Office programs that's already being exploited by hackers.

2026-05-23 21:53 UTC
Beyond the Patch: Deep Analysis of CVE-2026-21509 and OLE Mitigation ...

web:www.penligent.ai

This article provides a technical breakdown, actionable remediation code, and strategies for automated verification. Beyond the Patch : Deep Analysis of CVE - 2026 -21509 and OLE Mitigation Bypasses Technical Deep Dive: The Mechanics of the Bypass CVE - 2026 -21509 is classified as a Security Feature Bypass with a CVSS score of 7.8.

2026-05-23 21:53 UTC
CVE-2026-21509 | Tenable®

web:www.tenable.com

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

2026-05-23 21:53 UTC
Office zero-day exploited, forces Microsoft OOB patch

web:www.theregister.com

Office zero-day exploited in the wild forces Microsoft OOB patch Another actively abused Office bug, another emergency patch - Office 2016 and 2019 users are left with registry tweaks instead of fixes.

2026-05-23 21:53 UTC
Microsoft Office 2026 Zero-Day (CVE-2026-21509): Emergency Patch for ...

web:aviatrix.ai

A critical zero-day ( CVE - 2026 -21509) in Microsoft Office led to active exploitation and an emergency patch . Learn about the impact and urgent mitigation steps.

2026-05-26 02:48 UTC
Microsoft Office Zero-Day Vulnerability, CVE-2026-21509, Under Active ...

web:xmcyber.com

On January 26, 2026 , Microsoft issued emergency out-of-band security patches for a high-severity security feature bypass vulnerability in Microsoft Office, tracked as CVE - 2026 -21509. This vulnerability is currently being exploited in the wild, leading the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) Catalog.

2026-05-26 02:48 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-41509.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T14:15:13.606996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T14:15:21.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CROSS-implementation",
          "vendor": "CROSS-signature",
          "versions": [
            {
              "status": "affected",
              "version": "< fc6b7e78cdf789bb5c395a81dc601356f1383da0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T13:47:17.770Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CROSS-signature/CROSS-implementation/security/advisories/GHSA-w72c-hgx8-p7cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CROSS-signature/CROSS-implementation/security/advisories/GHSA-w72c-hgx8-p7cv"
        },
        {
          "name": "https://github.com/CROSS-signature/CROSS-implementation/commit/fc6b7e78cdf789bb5c395a81dc601356f1383da0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CROSS-signature/CROSS-implementation/commit/fc6b7e78cdf789bb5c395a81dc601356f1383da0"
        }
      ],
      "source": {
        "advisory": "GHSA-w72c-hgx8-p7cv",
        "discovery": "UNKNOWN"
      },
      "title": "Integer underflow in crypto_sign_open() leads to buffer overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41509",
    "datePublished": "2026-05-08T13:47:17.770Z",
    "dateReserved": "2026-04-20T18:18:50.681Z",
    "dateUpdated": "2026-05-08T14:15:21.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}