CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption

Q: What is the severity of CVE-2026-9076?

CVE-2026-9076 has a high severity rating of 7.5 on the CVSS scale.

Q: How do I fix CVE-2026-9076?

To mitigate CVE-2026-9076, you should update to the latest version of OpenSSL that addresses this vulnerability.

Q: What type of vulnerability is CVE-2026-9076?

CVE-2026-9076 is an out-of-bounds read vulnerability in the CMS password-based decryption process.

Q: Which software is affected by CVE-2026-9076?

CVE-2026-9076 affects OpenSSL and specifically the Debian implementation of OpenSSL.

Q: What are the potential impacts of exploiting CVE-2026-9076?

Exploiting CVE-2026-9076 could allow an attacker to cause a denial of service by triggering a heap out-of-bounds read.

Published May 27, 2026

Updated

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kekunwrapkey().

Other sources

Out-of-Bounds Read in CMS Password-Based Decryption

— Microsoft

Affected Software

11 affected componentsFixes available

OpenSSL OpenSSL

debian/openssl<=1.1.1w-0+deb11u1, <=1.1.1w-0+deb11u7, <=3.0.20-1~deb12u1, <=3.5.6-1~deb13u1, <=3.6.2-1

3.0.20-1~deb12u23.5.6-1~deb13u2

OpenSSL OpenSSL>=1.0.2<1.0.2zq

OpenSSL OpenSSL>=1.1.1<1.1.1zh

OpenSSL OpenSSL>=3.0.0<3.0.21

OpenSSL OpenSSL>=3.4.0<3.4.6

OpenSSL OpenSSL>=3.5.0<3.5.7

OpenSSL OpenSSL>=3.6.0<3.6.3

OpenSSL OpenSSL=4.0.0

Microsoft azl3 edk2 20240524git3e722403cd16-17<20240524git3e722403cd16-18

20240524git3e722403cd16-18

Microsoft azl3 openssl 3.3.5-5<3.3.7-3

3.3.7-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssl to a version that resolves this vulnerability.
Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-18
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3
Upgrade
Upgrade OpenSSL 1.0.2 to a version that resolves this vulnerability.
Fixed in 1.0.2zq
Upgrade
Upgrade OpenSSL 1.1.1 to a version that resolves this vulnerability.
Fixed in 1.1.1zh
Upgrade
Upgrade OpenSSL 3.0 to a version that resolves this vulnerability.
Fixed in 3.0.21
Upgrade
Upgrade OpenSSL 3.4 to a version that resolves this vulnerability.
Fixed in 3.4.6
Upgrade
Upgrade OpenSSL 3.5 to a version that resolves this vulnerability.
Fixed in 3.5.7
Upgrade
Upgrade OpenSSL 3.6 to a version that resolves this vulnerability.
Fixed in 3.6.3
Upgrade
Upgrade OpenSSL 4.0 to a version that resolves this vulnerability.
Fixed in 4.0.1

Event History

May 27, 2026

Data Sourced

via Red Hat·01:17 PM

DescriptionSeverityAffected Software

Jun 9, 2026

CVE Published

via MITRE·04:03 PM

Data Sourced

via MITRE·04:03 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

RemedyAffected Software

Data Sourced

via Ubuntu·08:07 PM

RemedyDescriptionSeverityAffected Software

Jun 10, 2026

Data Sourced

via Launchpad·08:09 PM

Description

Data Sourced

via Debian·08:09 PM

DescriptionAffected Software

Jun 13, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·08:04 AM

Affected Software

Updated

via Microsoft·08:04 AM

DescriptionSeverity

Jul 4, 58624

Event

via FIRST·05:50 PM

Frequently Asked Questions

What is the severity of CVE-2026-9076?

CVE-2026-9076 has a high severity rating of 7.5 on the CVSS scale.

How do I fix CVE-2026-9076?

To mitigate CVE-2026-9076, you should update to the latest version of OpenSSL that addresses this vulnerability.

What type of vulnerability is CVE-2026-9076?

CVE-2026-9076 is an out-of-bounds read vulnerability in the CMS password-based decryption process.

Which software is affected by CVE-2026-9076?

CVE-2026-9076 affects OpenSSL and specifically the Debian implementation of OpenSSL.

What are the potential impacts of exploiting CVE-2026-9076?

Exploiting CVE-2026-9076 could allow an attacker to cause a denial of service by triggering a heap out-of-bounds read.

CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-9076?

How do I fix CVE-2026-9076?

What type of vulnerability is CVE-2026-9076?

Which software is affected by CVE-2026-9076?

What are the potential impacts of exploiting CVE-2026-9076?

Company

Resources

Contact