AIKIDO-2026-722568

TL;DR

OpenSSL parses AEAD cipher parameters from CMS AuthEnvelopedData and EnvelopedData structures during decryption. The initialization vector encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without checking that its length fits, so an oversized IV in a crafted message triggers a stack-based out-of-bounds write. The write occurs before any authentication or tag verification, so no valid key material is needed to reach it, and it can crash the process or potentially lead to remote code execution. The fix validates the IV length against the destination buffer size before copying.