{"id":"CVE-2026-63072","title":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-b…","summary":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-b…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-787"],"vendor":"openssl","product":"openssl","affected":["openssl >= 3.0.0, < 3.0.22","openssl >= 3.4.0, < 3.4.7","openssl >= 3.5.0, < 3.5.8","openssl >= 3.6.0, < 3.6.4","openssl >= 4.0.0, < 4.0.2"],"patched":["openssl 4.0.2"],"published":"2026-08-25","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:16:34.287","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","references":[{"url":"https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","label":"openssl-security@openssl.org"},{"url":"https://openssl-library.org/news/secadv/20260825.txt","label":"openssl-security@openssl.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63072"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517560"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63072"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072"},{"url":"https://access.redhat.com/errata/RHSA-2026:67154"},{"url":"https://access.redhat.com/errata/RHSA-2026:67165"},{"url":"https://access.redhat.com/errata/RHSA-2026:59641"},{"url":"https://access.redhat.com/errata/RHSA-2026:59635"},{"url":"https://access.redhat.com/errata/RHSA-2026:67956"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-25T14:29:50.344129Z"},"ingestedAt":"2026-09-13T16:02:42.973Z","epss":0.00676,"epssPercentile":0.5041,"exploits":{"github":1,"githubRepos":["https://github.com/0xBlackash/CVE-2026-63072"],"checkedAt":"2026-09-21T15:29:58.363Z"},"exploitAvailable":true,"slug":"CVE-2026-63072","body":"## Overview\n\nIssue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE.\n\n## Affected\n\n- `openssl >= 3.0.0, < 3.0.22`\n- `openssl >= 3.4.0, < 3.4.7`\n- `openssl >= 3.5.0, < 3.5.8`\n- `openssl >= 3.6.0, < 3.6.4`\n- `openssl >= 4.0.0, < 4.0.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl 4.0.2`\n\n## Vendor advisories\n\n- **RHSA-2026:67154** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67154)\n- **RHSA-2026:67165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67165)\n- **RHSA-2026:59641** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59641)\n- **RHSA-2026:59635** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59635)\n- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services, … · no fix planned: Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat Developer Hub, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json)\n- **RHSA-2026:67956** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67956)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":183321,"id":"CVE-2026-63072","ts":1789356043931,"field":"exploit_available","old":"false","new":"true"}]}