What is the CVSS score of EUVD-2026-35474?

EUVD-2026-35474 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of OpenSSL are affected by EUVD-2026-35474?

OpenSSL versions prior to 4.0.1 contain a remote code execution vulnerability in ASN.1 string processing (CVSS 8.1) affecting any organization using this library for cryptographic operations.. A patch is available.

How to fix or mitigate EUVD-2026-35474?

Within 24 hours: Complete inventory of systems running OpenSSL versions prior to 4.0.1. Within 7 days: Deploy and test OpenSSL 4.0.1 in staging environments to verify application compatibility. Within 30 days: Rollout OpenSSL 4.0.1 patch to all production systems.

OpenSSL EUVD-2026-35474

| CVE-2026-7383 HIGH

Out-of-bounds Write (CWE-787)

2026-06-09

GHSA-w853-v86g-gv7j

OpenSSL Memory Corruption Buffer Overflow

High

Disputed · 8.1 Vendor

Severity by source

Sources disagree (Low–High)

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 17:22 vuln.today

Analysis Generated

Jun 09, 2026 - 17:22 vuln.today

CVSS changed

Jun 09, 2026 - 17:22 NVD

8.1 (HIGH)

CVE Published

Jun 09, 2026 - 11:43 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 11:43 nvd

HIGH 8.1

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Articles & Coverage 1

News 7 New OpenSSL Vulnerabilities - 1 Critical, 6 High Severity Jun 10, 2026

AnalysisAI

Heap buffer overflow in OpenSSL's ASN.1 multibyte string conversion routine allows remote attackers to corrupt memory and potentially achieve code execution against applications using affected OpenSSL versions prior to 4.0.1. The flaw was disclosed via the OpenSSL 4.0.1 security patch release alongside 17 other CVEs and is classified as a high-severity issue (CVSS 8.1) with no public exploit identified at time of analysis.

Technical ContextAI

OpenSSL is the de facto cryptographic library underpinning TLS, S/MIME, X.509 certificate handling, and PKCS standards across servers, clients, and embedded systems worldwide. The vulnerability sits in the ASN.1 (Abstract Syntax Notation One) multibyte string conversion logic, which transforms encoded character data between formats such as BMPString, UTF8String, and PrintableString during parsing of certificates, CMS/PKCS#7 messages, and other ASN.1-encoded structures. The CWE-787 (Out-of-bounds Write) classification combined with the 'heap buffer overflow' wording in the release notes indicates incorrect length calculation or boundary handling when copying converted characters into a heap-allocated destination buffer, which is a classic vector for memory corruption and potential RCE.

RemediationAI

Vendor-released patch: OpenSSL 4.0.1 - upgrade immediately to this version via https://github.com/openssl/openssl/releases/tag/openssl-4.0.1 and consult the official advisory at https://openssl-library.org/news/secadv/20260609.txt for branch-specific guidance. Operators should rebuild or update all dependent applications, packages, and container images that link against OpenSSL, prioritizing internet-facing TLS terminators, certificate validation services, and CMS/PKCS#7 message processors. If immediate patching is infeasible, compensating controls include restricting which peers can present certificates to the affected service (mutual-TLS allowlisting), placing a patched TLS-terminating proxy in front of vulnerable backends so the proxy handles ASN.1 parsing, and disabling code paths that process attacker-controlled S/MIME or PKCS#7 payloads - each of these reduces exposure but does not eliminate risk on internal trust paths and may break legitimate certificate chains.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

CVE-2014-3470 MEDIUM This Month

4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before

CVE-2017-3730 HIGH Act Now POC

7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH Act Now

7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Affected
SUSE Linux Enterprise Micro 5.3	Affected

EUVD-2026-35474 vulnerability details – vuln.today

Back

OpenSSL EUVD-2026-35474

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in OpenSSL

Same weakness CWE-787 – Out-of-bounds Write

Same technique Memory Corruption

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code