CVE-2026-111458 (GCVE-0-2026-111458)
Vulnerability from cvelistv5 – Published: 2026-10-16 05:24 – Updated: 2026-10-16 12:30
VLAI
EPSS
VEX
Title
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
Summary
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-16 05:20 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 12:30 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/adulau/ssldump/commit/8ad55683… | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-16 05:20 - Model
qwen3.8:27b- Input
-
https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
454d108335b2… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
8ad55683cc01
|
Fix heap overflow in FAN/1 X.509 fingerprint formatting | 454d108335b2… |
Fix summary
The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.
Patch summary
In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.
CVSS rationale
AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.
Weakness rationale
- CWE-122 The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation.
- CWE-787 The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category.
Attack pattern rationale
- CAPEC-109 CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog.
Assumptions to verify
- The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.
- The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).
- The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.
- The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.
- No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.
- The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-10-16 04:32 UTC Fix developed Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:30:53.251Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
},
{
"lang": "en",
"type": "finder",
"value": "https://github.com/TristanInSec"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.\u003c/p\u003e"
}
],
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"impacts": [
{
"capecId": "CAPEC-109",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-109 Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T05:26:55.129Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.\u003c/p\u003e"
}
],
"value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.",
"The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).",
"The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.",
"The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.",
"No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.",
"The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."
],
"capecRationale": [
{
"capecId": "CAPEC-109",
"rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."
}
],
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
}
],
"cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.",
"fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.",
"generatedAt": "2026-10-16T05:20:29.596478Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.",
"patchTruncated": false,
"patches": [
{
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"date": "Fri, 16 Oct 2026 04:32:38 +0000",
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"
}
],
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"weaknessRationale": [
{
"cweId": "CWE-122",
"rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."
},
{
"cweId": "CWE-787",
"rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"
],
"timestamp": "2026-10-16T04:32:38Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20308"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-111458",
"datePublished": "2026-10-16T05:24:43.178Z",
"dateReserved": "2026-10-16T05:24:32.520Z",
"dateUpdated": "2026-10-16T12:30:53.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-111458",
"date": "2026-10-16",
"epss": "0.00094",
"percentile": "0.00567"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"id": "CVE-2026-111458",
"lastModified": "2026-10-16T20:04:29.760",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"ssvcData": {
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-111458",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-16T06:17:09.510",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
},
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-10-16T22:00:13+00:00",
"cve": "CVE-2026-111458",
"id": "CVE-2026-111458",
"initial_release_date": "2026-10-16T05:24:43.178000+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "ssldump: ssldump: Arbitrary code execution via heap-based buffer overflow in certificate fingerprint formatting",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111458.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T12:30:41.664327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:30:48.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl/sslxprint.c (fanx_fingerprint)"
],
"product": "ssldump",
"programFiles": [
"ssl/sslxprint.c"
],
"repo": "https://github.com/adulau/ssldump",
"vendor": "adulau",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
},
{
"lang": "en",
"type": "finder",
"value": "https://github.com/TristanInSec"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.\u003c/p\u003e"
}
],
"value": "The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool."
}
],
"impacts": [
{
"capecId": "CAPEC-109",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-109 Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T05:26:55.129Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.\u003c/p\u003e"
}
],
"value": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is unspecified; the patch does not include version tags or release boundaries. All versions of ssldump containing the vulnerable fanx_fingerprint implementation prior to this commit are assumed affected.",
"The attack vector is assumed to be Local (AV:L) based on the common use case of analyzing pcap files. If ssldump is deployed in a live-capture configuration where an attacker can inject crafted TLS traffic, the vector could be Network (AV:N).",
"The 3-byte heap overflow is assumed to have the potential for code execution (VI:H, VA:H). In practice, a 3-byte overflow may more reliably cause a crash (DoS) than reliable code execution, but the worst-case impact is used for scoring.",
"The CAPEC-109 mapping is the closest available pattern; no CAPEC specifically addresses heap buffer overflows caused by size miscalculation.",
"No vendor, product version, or fixed version is specified in the patch metadata; these are marked as unknown/unspecified.",
"The user interaction is classified as Active (UI:A) because the user must explicitly run ssldump on a crafted input file."
],
"capecRationale": [
{
"capecId": "CAPEC-109",
"rationale": "CAPEC-109 describes attacks that exploit programs writing data to buffers without adequate length checking. In this case, the attacker supplies a pcap file containing a TLS X.509 certificate; ssldump processes it and the undersized heap buffer is overflowed by sprintf. The mapping is the closest available CAPEC for a heap buffer overflow triggered by crafted input. Uncertainty: CAPEC-109 is a general pattern and does not specifically call out heap overflows or off-by-N size miscalculations, but no more specific CAPEC exists in the catalog."
}
],
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Dulaunoy"
}
],
"cvssRationale": "AV:L: The attacker must supply a crafted pcap file to a local instance of ssldump; no network vector is assumed. AC:L: The overflow is deterministic and triggered by any valid X.509 certificate processed through the FAN/1 fingerprint path. AT:N: No special conditions on the target are required. PR:N: No privileges beyond normal user access to run ssldump are needed. UI:A: The user must actively open or process the crafted input file. VC:N: No direct confidentiality impact is evident from a 3-byte heap overflow. VI:H: Heap corruption can lead to arbitrary code execution, compromising integrity. VA:H: Heap corruption can cause a crash, denying service. SC/SI/SA:N: No subsequent system impact is evidenced.",
"fixSummary": "The fix replaces the hardcoded size calculation and unbounded sprintf with a two-step snprintf approach: first computing the exact required output length via snprintf(NULL, 0, format, b64, hex), then allocating precisely that length plus one byte for the null terminator via calloc, and finally writing the formatted string with a bounded snprintf. This eliminates the undersized allocation and guarantees the write never exceeds the allocated buffer.",
"generatedAt": "2026-10-16T05:20:29.596478Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"patchSummary": "In ssl/sslxprint.c, the fanx_fingerprint function is modified to extract the format string into a static const array, compute the exact output length using snprintf(NULL, 0, format, b64, hex), allocate fp_len + 1 bytes via calloc, and write with snprintf(fp, (size_t)fp_len + 1, format, b64, hex). A new Python regression test (tests/test_fan1_x509.py) is added that runs ssldump on a sample pcap and verifies each FAN/1 X.509 fingerprint against independently computed base64url and SHA-256 values. CMakeLists.txt is updated to register the test via CTest when Python 3 is available. The GitHub Actions CI workflow is extended to run the test suite and an additional AddressSanitizer-instrumented build to detect invalid buffer accesses.",
"patchTruncated": false,
"patches": [
{
"commit": "8ad55683cc0186600c085d33be5a5b627db78467",
"date": "Fri, 16 Oct 2026 04:32:38 +0000",
"patchSha256": "454d108335b2b8e3639175cd7b72e244d8bff879625ffe18e7dbbaa9ab995bfc",
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"sourceUrl": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting"
}
],
"source": "https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-16T05:20:29Z",
"version": "2.0.3"
},
"subject": "Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"weaknessRationale": [
{
"cweId": "CWE-122",
"rationale": "The function allocates a heap buffer via calloc that is 3 bytes smaller than the actual formatted output, and sprintf writes past the end of the allocated region. This is a textbook heap-based buffer overflow caused by an incorrect size calculation."
},
{
"cweId": "CWE-787",
"rationale": "The sprintf call writes 3 bytes beyond the end of the heap-allocated buffer, constituting an out-of-bounds write. CWE-122 is the more specific child; CWE-787 is included as the broader category."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (8ad55683cc0186600c085d33be5a5b627db78467): Fix heap overflow in FAN/1 X.509 fingerprint formatting",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467.patch"
],
"timestamp": "2026-10-16T04:32:38Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20308"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-111458",
"datePublished": "2026-10-16T05:24:43.178Z",
"dateReserved": "2026-10-16T05:24:32.520Z",
"dateUpdated": "2026-10-16T12:30:53.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.