CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping
Heap Buffer Overflow in CMS Key Unwrapping
Other sources
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.5.7-1~deb13u2Fixed in 3.6.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-19 - Compensating control
Modify the CMS code to size the AES-WRAP-PAD unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation.
Event History
Frequently Asked Questions
Is a non-default configuration required for exploitation?
No. The issue requires no special configuration and is reachable when a victim decrypts a crafted CMS message with CMS_decrypt().
What must an attacker provide to trigger the issue?
The attacker must supply a crafted CMS message for decryption. They can modify a legitimate message by changing a single key-wrap OID byte to select the AES-WRAP-PAD variant while leaving the rest of the message valid.
Does the CMS message decrypt successfully after the overwrite?
No. The unwrap operation ultimately fails its RFC 5649 integrity check because the unwrap key is derived from the recipient's private operation, such as ECDH key agreement or ML-KEM decapsulation. The out-of-bounds write occurs before the integrity failure is returned.
What is the expected impact of a successful trigger?
The write is a deterministic 8-byte, zero-value heap overflow immediately after the allocated buffer. It typically results in a denial of service through heap corruption.