--- id: CVE-2026-63072 title: |- Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-b… summary: |- Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-b… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-787 vendor: openssl product: openssl affected: - 'openssl >= 3.0.0, < 3.0.22' - 'openssl >= 3.4.0, < 3.4.7' - 'openssl >= 3.5.0, < 3.5.8' - 'openssl >= 3.6.0, < 3.6.4' - 'openssl >= 4.0.0, < 4.0.2' patched: - openssl 4.0.2 published: '2026-08-25' updated: '2026-09-11' sourceUpdated: '2026-09-11T21:16:34.287' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63072' references: - url: >- https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382 label: openssl-security@openssl.org - url: 'https://openssl-library.org/news/secadv/20260825.txt' label: openssl-security@openssl.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json - url: 'https://access.redhat.com/security/cve/CVE-2026-63072' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517560' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63072' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63072' - url: 'https://access.redhat.com/errata/RHSA-2026:67154' - url: 'https://access.redhat.com/errata/RHSA-2026:67165' - url: 'https://access.redhat.com/errata/RHSA-2026:59641' - url: 'https://access.redhat.com/errata/RHSA-2026:59635' - url: 'https://access.redhat.com/errata/RHSA-2026:67956' - url: 'https://access.redhat.com/errata/RHSA-2026:71603' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-08-25T14:29:50.344129Z' ingestedAt: '2026-09-13T16:02:42.973Z' epss: 0.01009 epssPercentile: 0.61578 exploits: github: 1 githubRepos: - 'https://github.com/0xBlackash/CVE-2026-63072' checkedAt: '2026-09-26T09:05:54.706Z' exploitAvailable: true --- ## Overview Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. ## Affected - `openssl >= 3.0.0, < 3.0.22` - `openssl >= 3.4.0, < 3.4.7` - `openssl >= 3.5.0, < 3.5.8` - `openssl >= 3.6.0, < 3.6.4` - `openssl >= 4.0.0, < 4.0.2` ## Remediation Upgrade past the affected range: - `openssl 4.0.2` ## Vendor advisories - **RHSA-2026:67154** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67154) - **RHSA-2026:67165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67165) - **RHSA-2026:59641** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59641) - **RHSA-2026:59635** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59635) - **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services, … · no fix planned: Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat Developer Hub, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json) - **RHSA-2026:67956** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67956) - **RHSA-2026:71603** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71603)