Out of Bounds Read Vulnerability in OpenSSL Product during Email Validation

CVE-2026-42771

What is CVE-2026-42771?

A vulnerability exists in OpenSSL related to email address validation during S/MIME message processing. Specifically, when an application invokes the X509_VERIFY_PARAM_set1_email function, it may lead to an out of bounds read due to incorrect handling of the length for the local part of an email address. This flaw could result in an application crash, potentially leading to a Denial of Service, especially when a specially crafted 'From:' address is encountered. The 64 octet limit for the email local part may not be correctly enforced in such scenarios. Importantly, this vulnerability does not allow for direct data exfiltration, as the data read is not exposed to the attacker. The issue does not affect any FIPS-compliant modules since the problematic code lies outside the FIPS module boundary.

References