The library tiny-AES128-C contains a buffer overflow in its AES128_CBC_encrypt_buffer() function, where 15 bytes beyond the end of the input buffer can be overwritten.