# crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption

CVE record · `CVE-2026-43033`

- **Identifiers:** `CVE-2026-43033`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-682](https://cwe.mitre.org/data/definitions/682.html)
- **Tags:** [CWE-682](https://agentprime.io/advisories/tag/cwe-682.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 1 May 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 1 May 2026, 14:15 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 8c62f618576519dbed6816fafc623ce592953025` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before d589abd8b019b07075fda255ceab8c8e950cdb3f` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before d0c4ff6812386880f30bc64c2921299cc4d7b47f` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 89fe118b6470119b20c04afc36e45b81a69ea11f` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before 153d5520c3f9fd62e71c7e7f9e34b59cf411e555` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before cded4002d22177e8deaca1f257ecd932c9582b6b` (git)
  - affected: `104880a6b470958ddc30e139c41aa4f6ed3a5234 to before e02494114ebf7c8b42777c6cd6982f113bfdbec7` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.3`
  - unaffected: `before 4.3` (semver)
  - unaffected: `5.10.254 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.204 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.170 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.137 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.85 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.22 to 6.18.*, inclusive` (semver)
  - unaffected: `6.19.12 to 6.19.*, inclusive` (semver)
  - unaffected: `7.0 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0014, the 3rd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 1 May 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-43033](https://www.cve.org/CVERecord?id=CVE-2026-43033)
- [NVD: CVE-2026-43033](https://nvd.nist.gov/vuln/detail/CVE-2026-43033)

### References from the CNA

- <https://git.kernel.org/stable/c/8c62f618576519dbed6816fafc623ce592953025>
- <https://git.kernel.org/stable/c/d589abd8b019b07075fda255ceab8c8e950cdb3f>
- <https://git.kernel.org/stable/c/5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5>
- <https://git.kernel.org/stable/c/d0c4ff6812386880f30bc64c2921299cc4d7b47f>
- <https://git.kernel.org/stable/c/89fe118b6470119b20c04afc36e45b81a69ea11f>
- <https://git.kernel.org/stable/c/153d5520c3f9fd62e71c7e7f9e34b59cf411e555>
- <https://git.kernel.org/stable/c/cded4002d22177e8deaca1f257ecd932c9582b6b>
- <https://git.kernel.org/stable/c/e02494114ebf7c8b42777c6cd6982f113bfdbec7>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-43033>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-43033/>. Everything for agents: <https://agentprime.io/llms.txt>.