AIKIDO-2026-297573

TL;DR

The function mbedtls_lms_import_public_key() reads a 4-byte LMS type indicator at the start of the public key before validating that the input buffer is large enough. Supplying a truncated public key shorter than four bytes causes an out-of-bounds read of up to four bytes. This can crash the process or leak whether those bytes match a fixed value, with no code execution or large-scale disclosure. The fix validates the input length before reading the type indicator.