Snippet from a report we received on 2026-05-17:

Libgcrypt accepts a canonical atom length that is larger than what its
internal S-expression representation can safely store, so it later
remembers the wrong end of the atom and can read past the end of the heap
buffer.

More specifically, the canonical LEN:DATA parser accepts
attacker-controlled atom lengths larger than 65535 bytes. That length is
later stored in the internal DATALEN field, which is 16-bit. When the
oversized length is stored, it is silently truncated. From that point on,
the parser and the internal representation no longer agree about where the
atom actually ends.

Reported-by: Ciwan Öztopal