What is the CVSS score of CVE-2026-41681?

CVE-2026-41681 has a CVSS 4.0 base score of 8.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-41681?

Within 24 hours: Identify all internal and third-party applications using rust-openssl by reviewing dependency manifests (Cargo.lock, Cargo.toml) and container images. Within 7 days: Update rust-openssl to version 0.10.78 or later (commit 826c3888) across all development, staging, and production environments; coordinate with development teams and re-run integration tests. Within 30 days: Conduct memory safety audit of cryptographic code paths using miri or sanitizers; review logs for potential exploitation attempts; document remediation in security inventory.

rust-openssl CVE-2026-41681

Q: Which versions of rust-openssl are affected by CVE-2026-41681?

CVE-2026-41681 is a stack-based buffer overflow in rust-openssl that allows safe Rust code to corrupt memory when processing cryptographic digests, potentially enabling attackers to compromise…. A patch is available.

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-22 https://github.com/rust-openssl/rust-openssl

GHSA-ghm9-cr32-g9qj

Buffer Overflow Stack Overflow Suse

8.1

CVSS 4.0 · Vendor: https://github.com/rust-openssl/rust-openssl

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify target using rust-openssl <0.10.78
Delivery

Trigger digest operation with undersized output buffer
Exploit

EVP_DigestFinal writes beyond buffer boundary
Execution

Stack memory corruption occurs
Impact

Application crashes or executes attacker-controlled code

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the Rust application to pass an output buffer to MdCtxRef::digest_final() that is smaller than EVP_MD_CTX_size(ctx) bytes for the configured hash algorithm. This typically occurs when applications dynamically allocate digest output buffers based on incorrect size calculations, user-controlled length parameters, or when reusing fixed-size buffers intended for shorter hash algorithms with longer ones (e.g., using a 16-byte buffer sized for MD5 with SHA-256 requiring 32 bytes). Limiting factors include: the vulnerability is only reachable through specific digest finalization code paths in rust-openssl versions prior to 0.10.78, exploitation requires some degree of application-level control over buffer sizing logic rather than direct memory corruption primitives, and achieving code execution beyond crashes requires precise stack layout knowledge specific to the target architecture and compiler optimization level. Applications using correctly-sized static buffers matching their chosen hash algorithms are not vulnerable.
Impact	Real-world risk is elevated due to the violation of Rust's memory safety guarantees from safe code paths. While CVSS data is unavailable, the attack characteristics suggest moderate complexity: exploitation requires an attacker to control or influence the size of the output buffer passed to digest_final(), which is typically determined by application logic rather than direct user input. The stack corruption can lead to denial of service (crash) reliably, but arbitrary code execution would require precise control over buffer sizes and stack layout, making it architecture and application-specific. EPSS data unavailable. Not listed in CISA KEV, indicating no confirmed widespread exploitation. However, the availability of a specific GitHub commit (826c3888) and detailed advisory (GHSA-ghm9-cr32-g9qj) provides attackers with precise exploitation guidance. Primary risk is to Rust applications that assume cryptographic operations are memory-safe and therefore don't implement additional buffer validation. Applications using digest operations with dynamically-sized or user-influenced output buffers face higher risk than those using fixed-size buffers matching expected digest lengths.
Exploit ScenarioDerived	A Rust web application uses rust-openssl to compute cryptographic hashes of user-uploaded files. The application allocates an output buffer based on an incorrectly calculated or user-influenced size that is smaller than the actual digest length. When calling MdCtxRef::digest_final() from safe Rust code, EVP_DigestFinal() writes the full 32-byte SHA-256 digest into the undersized buffer, overflowing onto adjacent stack variables. The attacker manipulates upload parameters to trigger this condition repeatedly, corrupting stack-based function pointers or return addresses, potentially achieving code execution or causing the application to crash and deny service to legitimate users.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 23, 2026

Stack-based buffer overflow in rust-openssl's MdCtxRef::digest_final() allows safe Rust code to corrupt memory when EVP_DigestFinal() writes beyond the provided output buffer boundary. The vulnerability occurs when the output buffer is smaller than EVP_MD_CTX_size(ctx), causing EVP_DigestFinal() to write past the buffer end and corrupt stack memory. Vendor-released patch available in version 0.10.78 via GitHub commit 826c3888. No public exploit identified at time of analysis, but exploitable from memory-safe Rust code paths, violating Rust's safety guarantees.

RemediationAI

Upgrade rust-openssl to version 0.10.78 or later, which contains the fix implemented in commit 826c3888b77add418b394770e2b2e3a72d9f92fe (https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe). Update the dependency in Cargo.toml to openssl = "0.10.78" and run cargo update. Review the patch at https://github.com/rust-openssl/rust-openssl/pull/2608 to understand the fix implementation. If immediate upgrade is not feasible, implement a temporary workaround by manually validating that output buffers passed to MdCtxRef::digest_final() are sized to at least EVP_MD_size() bytes for the hash algorithm in use (16 bytes for MD5, 32 for SHA-256, 64 for SHA-512). This requires calling unsafe OpenSSL FFI functions directly to check digest size before allocation, negating the safety benefits of the Rust wrapper. Alternatively, allocate conservatively large output buffers (64+ bytes) for all digest operations and accept the memory overhead, though this doesn't address the underlying API safety violation. Consult the full advisory at https://github.com/advisories/GHSA-ghm9-cr32-g9qj for additional context.

Affected Packages

cargo openssl fix: 0.10.78

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects the rust-openssl crate (pkg:rust/openssl), a Rust binding to the OpenSSL cryptographic library. The root cause is CWE-121 (Stack-based Buffer Overflow) in the MdCtxRef::digest_final() wrapper function. OpenSSL's EVP_DigestFinal() function unconditionally writes a fixed number of bytes determined by EVP_MD_CTX_size(ctx) to the output buffer, typically 16-64 bytes depending on the hash algorithm (MD5=16, SHA-256=32, SHA-512=64). The Rust binding failed to validate that the caller-provided output buffer was large enough before invoking the native OpenSSL function. This breaks Rust's memory safety model by allowing stack corruption from safe (non-unsafe) Rust code, which should be impossible in a correctly implemented safe API. The vulnerability exists in the binding layer between Rust's type system and OpenSSL's C API, where proper bounds checking was omitted.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/rust-openssl/rust-openssl) PRIMARY 8.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SUSE 5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (https://github.com/rust-openssl/rust-openssl).

CVSS VectorVendor: https://github.com/rust-openssl/rust-openssl

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 24, 2026 - 18:22 NVD

8.1 (HIGH)

Patch released

Apr 22, 2026 - 21:16 nvd

Patch available

CVE Published

Apr 22, 2026 - 21:05 nvd

HIGH 8.1

DescriptionCVE.org

EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust.

Executive ViewAI

Why It Matters

CVE-2026-41681 is a stack-based buffer overflow in rust-openssl that allows safe Rust code to corrupt memory when processing cryptographic digests, potentially enabling attackers to compromise applications built with vulnerable versions. This vulnerability violates Rust's memory safety guarantees and could lead to data breaches or system compromise in any organization using rust-openssl for cryptographic operations. Immediate patching is critical for applications handling sensitive data or deployed in production environments.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is blocked operationally, restrict access to affected applications to trusted networks only and monitor for abnormal process behavior or memory corruption indicators until patch deployment is completed.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Affected Products (CPE)CVE.org

pkg:rust/openssl

Same weakness CWE-121 – Stack-based Buffer Overflow

View all

CVE-2025-0282 CRITICAL POC

9.0

CVE-2025-22457 CRITICAL POC

9.8

CVE-2012-10060 CRITICAL POC

9.3

CVE-2012-10053 CRITICAL POC

9.3

CVE-2013-10064 CRITICAL POC

9.3

CVE-2012-10023 MEDIUM POC

6.9

CVE-2012-10058 CRITICAL POC

10.0

CVE-2013-10068 CRITICAL POC

9.4

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
Container suse/sl-micro/6.0/toolbox:latest	Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back