FKIE_CVE-2026-9076

Vulnerability from fkie_nvd - Published: 2026-06-09 17:17 - Updated: 2026-07-23 08:10
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.
References
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bbPatch
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0Patch
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98Patch
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26Patch
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6Patch
openssl-security@openssl.orghttps://openssl-library.org/news/secadv/20260609.txtVendor Advisory
Impacted products
Vendor Product Version
openssl openssl *
openssl openssl *
openssl openssl *
openssl openssl *
openssl openssl *
openssl openssl *
openssl openssl 4.0.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zh",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zq",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F534B804-67B6-49DA-8A86-0FF21E512908",
              "versionEndExcluding": "1.0.2zq",
              "versionStartIncluding": "1.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F",
              "versionEndExcluding": "1.1.1zh",
              "versionStartIncluding": "1.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDB88756-EDFE-4886-A267-3F19342A6042",
              "versionEndExcluding": "3.0.21",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF7E21E7-AEC0-4882-B1F1-2D056B506F22",
              "versionEndExcluding": "3.4.6",
              "versionStartIncluding": "3.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A",
              "versionEndExcluding": "3.5.7",
              "versionStartIncluding": "3.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker\u0027s PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Cuando el descifrado basado en contrase\u00f1a de CMS (RFC 3211 / desenvolvimiento de clave PWRI) procesa datos CMS suministrados por el atacante, un cifrado KEK en modo de flujo elegido por el atacante puede desencadenar una lectura fuera de l\u00edmites en el heap en kek_unwrap_key().\n\nResumen del impacto: Una lectura excesiva del b\u00fafer del heap puede desencadenar un fallo que lleva a la denegaci\u00f3n de servicio para una aplicaci\u00f3n si el b\u00fafer de entrada termina en un l\u00edmite de p\u00e1gina de memoria y la p\u00e1gina siguiente no est\u00e1 mapeada. No hay revelaci\u00f3n de informaci\u00f3n ya que los bytes le\u00eddos en exceso no se revelan al atacante.\n\nLa funci\u00f3n de desenvolvimiento de clave realiza una prueba de bytes de verificaci\u00f3n seg\u00fan lo especificado en el RFC que lee 7 bytes de una asignaci\u00f3n en el heap que se basa en la longitud de la clave envuelta del mensaje. Hay una verificaci\u00f3n de longitud m\u00ednima basada en la longitud de bloque del cifrado de envoltura. Sin embargo, el cifrado se selecciona de un OID transportado en el algoritmo de cifrado de clave PWRI del atacante sin el requisito de que el cifrado sea un cifrado de bloque. Cuando un atacante selecciona un cifrado en modo de flujo, la protecci\u00f3n ser\u00e1 ineficaz y el b\u00fafer asignado que contiene la clave desenvuelta puede ser demasiado peque\u00f1o para contener los bytes de verificaci\u00f3n especificados en el RFC y puede ocurrir una lectura excesiva del b\u00fafer.\n\nLas aplicaciones que llaman a \u0027CMS_decrypt()\u0027 o \u0027CMS_decrypt_set1_password()\u0027 (equivalentemente OpenSSL cms -decrypt -pwri_password ...) en datos CMS no confiables son vulnerables a este problema. No se requiere conocimiento de la contrase\u00f1a: la lectura excesiva ocurre durante el intento de desenvolvimiento antes de que cualquier autenticaci\u00f3n tenga \u00e9xito.\n\nLa lectura excesiva est\u00e1 limitada a unos pocos bytes y no se escribe en la salida, por lo que no hay revelaci\u00f3n de informaci\u00f3n. Desencadenar un fallo requiere que la asignaci\u00f3n limite con memoria no mapeada, lo cual es poco probable con el asignador normal.\n\nLos m\u00f3dulos FIPS no se ven afectados por este problema."
    }
  ],
  "id": "CVE-2026-9076",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9076",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T19:04:07.840133Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T17:17:50.997",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://openssl-library.org/news/secadv/20260609.txt"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.