OpenSSL CMS Decryption Vulnerability Affects OpenSSL Products

CVE-2026-63072

What is CVE-2026-63072?

An out-of-bounds heap write vulnerability exists in OpenSSL's CMS decryption, which occurs during the unwrapping of keys. By supplying a specially crafted CMS message, an attacker can cause an 8-byte overflow, resulting in heap corruption. This vulnerability can be exploited via the public CMS_decrypt() function, leading to a Denial of Service. The vulnerability is particularly concerning as it enables the attacker to manipulate the key-wrap OID in a way that corrupts the heap, disrupting normal operations. The OpenSSL team has addressed this issue in patches that ensure the unwrap output buffer is correctly sized to prevent such overflows.

References