CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy() can lead to a heap buffer overflow.
Other sources
Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.2zq - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.1zh - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7383?
The severity of CVE-2026-7383 is rated as high with a CVSS score of 8.1.
How do I fix CVE-2026-7383?
To fix CVE-2026-7383, upgrade to the latest version of OpenSSL that contains security patches addressing this vulnerability.
What causes CVE-2026-7383?
CVE-2026-7383 is caused by a signed integer overflow when sizing the destination buffer for Unicode output in the ASN1_mbstring_ncopy() function.
What are the potential impacts of CVE-2026-7383?
The potential impacts of CVE-2026-7383 include a heap buffer overflow that can lead to memory corruption or code execution.
Which software is affected by CVE-2026-7383?
CVE-2026-7383 affects OpenSSL and specifically the ASN.1 multibyte string conversion functions.