The Botan cryptography library suffers from a heap buffer overflow (CWE-787) in its Scrypt implementation on 32‑bit systems. The vulnerability arises when the library multiplies cost parameters without bounds checking, allowing an attacker‑controlled parameter set to wrap the calculated allocation size. This overflow causes the algorithm to write up to approximately four gigabytes of data past the allocated buffer, immediately crashing the process and resulting in a denial of service. The flaw does not enable arbitrary code execution in the documented cases, though the overwrite primitive could theoretically be exploited under more complex conditions.

This flaw affects any use of Randombit Botan between versions 2.7.0 and 3.12.x (the 3.13.0 release contains the fix) on 32‑bit architectures. Systems that enable Scrypt and accept arbitrary parameters from untrusted sources—such as applications that decrypt attacker‑supplied encrypted private keys—are at risk. Any deployment that relies on the vulnerable Scrypt implementation for key derivation or password hashing is potentially impacted.

The CVSS score of 4.1 indicates a moderate severity focus on denial of service. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not catalogued in CISA KEV. An attacker in practice would trigger the overflow by supplying malicious Scrypt parameters, which may be embedded in encrypted payloads processed by the application. Successful exploitation would crash the target process; while no code execution has been demonstrated, the buffer overwrite could theoretically lead to more severe compromise under specific conditions.