ZDI-CAN-30379: ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

Published Oct 22, 2026

Updated

This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-63073.

Affected Software

1 affected component

OpenSSL OpenSSL

Event History

Oct 22, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Does exploiting this issue require authentication?

No. Remote attackers can exploit the vulnerability without authentication.

What is the impact of successful exploitation?

Successful exploitation can disclose sensitive information from affected OpenSSL installations.

Which CVE identifies this vulnerability?

This issue is identified as CVE-2026-63073.

ZDI-CAN-30379: ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploiting this issue require authentication?

What is the impact of successful exploitation?

Which CVE identifies this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Does exploiting this issue require authentication?

What is the impact of successful exploitation?

Which CVE identifies this vulnerability?