Stack Corruption Vulnerability in rust-openssl OpenSSL Bindings

CVE-2026-41681

What is CVE-2026-41681?

The rust-openssl library, which provides OpenSSL bindings for the Rust programming language, is susceptible to a stack corruption issue. In specific versions from 0.10.39 to just before 0.10.78, the function EVP_DigestFinal() can wrongly write data past the allocated buffer if it is smaller than the expected size. This can lead to data corruption and potentially allow an attacker to exploit the vulnerability from safe Rust contexts. The issue has been addressed in version 0.10.78, and users are strongly encouraged to upgrade to this version to mitigate the risk.

References