OpenSSL CVE-2026-63072

No special configuration is required - the vulnerability is reachable from the public CMS_decrypt() API without any non-default settings. Both affected code paths (cms_kari.c for ECDH key agreement recipients, cms_kemri.c for ML-KEM recipients) are triggered whenever a CMS-encrypted message is decrypted and the key-wrap OID selects the padded variant. CVSS PR:N and UI:N confirm no authentication or victim interaction is needed; the attacker need only deliver a crafted CMS message to any reachable service invoking CMS_decrypt() on external input. Exploitation is bounded by the following limiting factors: the target must use OpenSSL for CMS decryption operations (applications not using CMS are entirely unaffected); the overflow is fixed at 8 bytes of zeros immediately past the allocation, constraining realistic impact to DoS under typical heap layouts; and FIPS-mode builds are not affected since the CMS code is outside the FIPS module boundary.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the attack surface: network-reachable, zero authentication, no user interaction required. SSVC corroborates with Automatable: yes, meaning an adversary can script mass delivery of crafted CMS messages without per-target manual effort, though SSVC Exploitation: none confirms no active exploitation at time of analysis. The DoS consequence is deterministic rather than probabilistic - heap corruption from the fixed-size overflow reliably crashes the target process. No EPSS score was included in the source data, so exploitation probability is inferred from the automatable SSVC flag and the straightforward, reproducible nature of the trigger. The absence of a KEV listing means no CISA-confirmed in-the-wild exploitation. Technical impact is assessed as partial (SSVC) because the 8-byte, zero-value, immediately-adjacent overflow limits the realistic exploitation ceiling to DoS under typical heap layouts, making arbitrary code execution unlikely but not theoretically impossible. The broad affected version range spanning 1.1.1 through 4.0.x, combined with OpenSSL's ubiquitous deployment, makes this a high organizational priority for any service performing CMS decryption on untrusted input.

An attacker intercepts or constructs a CMS-encrypted message targeting a service that calls OpenSSL's CMS_decrypt(), then modifies a single byte in the key-wrap OID field to substitute id-aesNNN-wrap-pad for id-aesNNN-wrap and delivers it to the target. The AES-WRAP-PAD primitive's integrity-failure path writes 8 zero bytes past the undersized heap allocation, corrupting adjacent heap metadata and causing the target process to crash. No public exploit code has been identified at time of analysis, but the fixed-size, deterministic nature of the overflow makes reliable DoS straightforward to reproduce once the OID substitution is understood.