Heap Buffer Overflow in OpenSSL Affecting X.509 Certificate Handling

CVE-2026-31789

What is CVE-2026-31789?

A heap buffer overflow vulnerability in OpenSSL can occur when converting an unusually large OCTET STRING in X.509 certificates, specifically in extensions like Subject Key Identifier and Authority Key Identifier. This issue arises on 32-bit platforms, where an attacker may craft a certificate with an excessively large OCTET STRING, leading to a potential crash or code execution due to improper buffer allocation. While printing or logging such large certificates is rare, this vulnerability underscores the importance of handling X.509 certificates securely.

References