EUVD-2026-65482
GHSA-wp5f-6q39-q2f4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CMS message delivery is fully network-reachable with no authentication or interaction required; only availability is affected via deterministic heap corruption.
Primary rating from Vendor (openssl).
CVSS VectorVendor: openssl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.
Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service.
CWE: CWE-787: Out-of-bounds Write
Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure.
The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation.
FIPS impact: no
As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
Articles & Coverage 1
AnalysisAI
Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required - the vulnerability is reachable from the public CMS_decrypt() API without any non-default settings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the attack surface: network-reachable, zero authentication, no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker intercepts or constructs a CMS-encrypted message targeting a service that calls OpenSSL's CMS_decrypt(), then modifies a single byte in the key-wrap OID field to substitute id-aesNNN-wrap-pad for id-aesNNN-wrap and delivers it to the target. The AES-WRAP-PAD primitive's integrity-failure path writes 8 zero bytes past the undersized heap allocation, corrupting adjacent heap metadata and causing the target process to crash. … |
| Remediation | The primary fix is to upgrade to a patched OpenSSL release: 1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2, as documented in the OpenSSL security advisory at https://openssl-library.org/news/secadv/20260825.txt. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and systems using OpenSSL that process CMS-encrypted data from external sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today