CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.
Affected Software
Event History
Frequently Asked Questions
Is a non-default configuration required for exploitation?
No. The issue requires no special configuration and is reachable when a victim decrypts a crafted CMS message with CMS_decrypt().
What must an attacker provide to trigger the issue?
The attacker must supply a crafted CMS message for decryption. They can modify a legitimate message by changing a single key-wrap OID byte to select the AES-WRAP-PAD variant while leaving the rest of the message valid.
Does the CMS message decrypt successfully after the overwrite?
No. The unwrap operation ultimately fails its RFC 5649 integrity check because the unwrap key is derived from the recipient's private operation, such as ECDH key agreement or ML-KEM decapsulation. The out-of-bounds write occurs before the integrity failure is returned.
What is the expected impact of a successful trigger?
The write is a deterministic 8-byte, zero-value heap overflow immediately after the allocated buffer. It typically results in a denial of service through heap corruption.