Heap Corruption Vulnerability in Rust OpenSSL Bindings Affecting Multiple Versions

CVE-2026-45784

What is CVE-2026-45784?

The rust-openssl library from versions 0.10.50 to 0.10.80 contains a vulnerability in the CipherCtxRef::cipher_update_inplace function, which mishandles buffer sizes when using AES key-wrap-with-padding ciphers. This results in the possibility of writing beyond the boundaries of allocated memory, leading to potential heap corruption, which can be exploited by attackers to cause unpredictable behavior or execute arbitrary code. Users are strongly advised to update to version 0.10.80 or later to mitigate this risk.

References