AIKIDO-2026-142108
openssl is vulnerable to Out-of-bounds Write
55
Medium Risk
This Affects:
opensslTL;DR
CMS decryption sizes the key unwrap output buffer from the reported unwrapped key length, but padded AES key unwrap can write and clear 8 bytes past that length. A CMS message whose key wrap algorithm identifier selects the padded variant reaches this write from CMS_decrypt(), and the integrity check then fails, which corrupts the heap and typically crashes the process. The fix sizes the output buffer for the largest write the unwrap can perform.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decrypts untrusted CMS messages.
Background info
openssl is vulnerable to Out-of-bounds Write in versions 1.1.1 - 3.0.21, 3.4.0 - 3.4.6, 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979agithub.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.