CVE-2026-41681: rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check
EVPDigestFinal() always writes EVPMDCTXsize(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digestfinal() writes past its end, usually corrupting the stack. This is reachable from safe Rust.
Other sources
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVPDigestFinal() always writes EVPMDCTXsize(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digestfinal() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/opensslto a version that resolves this vulnerability.Fixed in 0.10.78 - Upgrade
Upgrade
rust-opensslto a version that resolves this vulnerability.Fixed in 0.10.78
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41681?
CVE-2026-41681 is rated as a high severity vulnerability due to potential stack corruption.
How do I fix CVE-2026-41681?
To fix CVE-2026-41681, upgrade to OpenSSL version 0.10.78 or later.
What does CVE-2026-41681 affect?
CVE-2026-41681 affects the Rust package 'openssl' versions between 0.10.39 and 0.10.78.
What vulnerability does CVE-2026-41681 introduce?
CVE-2026-41681 introduces a buffer overflow vulnerability due to incorrect handling of output buffer sizes.
Can CVE-2026-41681 be exploited in safe Rust code?
Yes, CVE-2026-41681 is reachable from safe Rust code, making it a serious concern.