AIKIDO-2026-734568

TL;DR

CMP response checks convert the sender distinguished name and pass that string as the format argument to ERR_raise_data(). A sender name that contains percent specifiers is then formatted with no matching arguments, which reads or writes through unrelated stack values and crashes the client. This path runs when the client sets an expected sender or pins a server certificate. The fix passes the sender name as a data argument rather than as the format string.