Buffer Over-read Vulnerability in OpenSSL Affected on 64-bit Unix Platforms

CVE-2026-34180

What is CVE-2026-34180?

A critical buffer over-read vulnerability exists within OpenSSL's ASN.1 decoder that arises during the parsing of crafted DER-encoded ASN.1 structures. When a primitive element's content exceeds 2 gigabytes, the integer truncation leads to mishandled content length, which may result in a denial of service condition or allow the application to load memory contents beyond the intended input buffer. This issue predominantly affects applications utilizing the d2i_X509() and d2i_PKCS7() functions on 64-bit Unix and Unix-like systems, while 32-bit and 64-bit Windows platforms remain unaffected. It is crucial for developers and system administrators to review the OpenSSL patches to mitigate the risk associated with this vulnerability.

References