High · published January 27, 2026
CVSS calls it high at 8.8. It sits in the 99.0th percentile for exploit probability.
🚨 A well-crafted CMS message could lead to a stack overflow in OpenSSL, potentially causing chaos with just oversized parameters! 🔥 Think of it like a delivery service that accepts packages without checking their size. If someone sends a massive box, it could crash the whole system while the courier tries to squeeze it through the door! An attacker could exploit this vulnerability to cause a crash, leading to Denial of Service, or even worse, gain the ability to execute remote code! This means your server could be hijacked, leaving it wide open for mischief. Imagine the havoc that could ensue if an unauthorized user could run commands on your server!
Think of it like a delivery service that accepts packages without checking their size. If someone sends a massive box, it could crash the whole system while the courier tries to squeeze it through the door! This stack buffer overflow vulnerability occurs when the CMS (Auth)EnvelopedData structures fail to verify the size of the Initialization Vector (IV) before copying it to a fixed-size buffer, allowing attackers to overwrite adjacent memory locations without proper authentication.
An attacker could exploit this vulnerability to cause a crash, leading to Denial of Service, or even worse, gain the ability to execute remote code! This means your server could be hijacked, leaving it wide open for mischief. Imagine the havoc that could ensue if an unauthorized user could run commands on your server! To safeguard your systems, update to OpenSSL 3.6.0 or later. If you're using an older version, consider moving to the unaffected OpenSSL 1.1.1 or 1.0.2. Don’t forget to audit your applications to ensure they don’t process untrusted CMS or PKCS#7 content without proper checks! You can tackle this! Implement these fixes and keep your systems secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| openssl/openssl | ≥ 3.0.0, < 3.0.19 | 3.0.19 |
| openssl/openssl | ≥ 3.1.0, < 3.3.6 | 3.3.6 |
| openssl/openssl | ≥ 3.4.0, < 3.4.4 | 3.4.4 |
| openssl/openssl | ≥ 3.5.0, < 3.5.5 | 3.5.5 |
| openssl/openssl | ≥ 3.6.0, < 3.6.1 | 3.6.1 |