--- id: CVE-2026-63072 title: |- Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-b… summary: |- Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-b… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-787 vendor: openssl product: openssl affected: - 'openssl >= 3.0.0, < 3.0.22' - 'openssl >= 3.4.0, < 3.4.7' - 'openssl >= 3.5.0, < 3.5.8' - 'openssl >= 3.6.0, < 3.6.4' - 'openssl >= 4.0.0, < 4.0.2' patched: - openssl 4.0.2 published: '2026-08-25' updated: '2026-09-11' sourceUpdated: '2026-09-11T21:16:34.287' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63072' references: - url: >- https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382 label: openssl-security@openssl.org - url: 'https://openssl-library.org/news/secadv/20260825.txt' label: openssl-security@openssl.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json - url: 'https://access.redhat.com/security/cve/CVE-2026-63072' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517560' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63072' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63072' - url: 'https://access.redhat.com/errata/RHSA-2026:67154' - url: 'https://access.redhat.com/errata/RHSA-2026:67165' - url: 'https://access.redhat.com/errata/RHSA-2026:59641' - url: 'https://access.redhat.com/errata/RHSA-2026:59635' - url: 'https://access.redhat.com/errata/RHSA-2026:67956' - url: 'https://access.redhat.com/errata/RHSA-2026:71603' - url: 'https://access.redhat.com/errata/RHSA-2026:72475' - url: 'https://access.redhat.com/errata/RHSA-2026:72395' - url: 'https://access.redhat.com/errata/RHSA-2026:72399' - url: 'https://access.redhat.com/errata/RHSA-2026:72476' - url: 'https://access.redhat.com/errata/RHSA-2026:72470' - url: 'https://access.redhat.com/errata/RHSA-2026:72394' - url: 'https://access.redhat.com/errata/RHSA-2026:79357' - url: 'https://access.redhat.com/errata/RHSA-2026:79088' - url: 'https://access.redhat.com/errata/RHSA-2026:85249' - url: 'https://access.redhat.com/errata/RHSA-2026:89737' - url: 'https://access.redhat.com/errata/RHSA-2026:89736' - url: 'https://access.redhat.com/errata/RHSA-2026:89738' - url: 'https://access.redhat.com/errata/RHSA-2026:80514' - url: 'https://access.redhat.com/errata/RHSA-2026:85968' - url: 'https://access.redhat.com/errata/RHSA-2026:85970' - url: 'https://access.redhat.com/errata/RHSA-2026:81201' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-08-25T14:29:50.344129Z' ingestedAt: '2026-09-13T16:02:42.973Z' epss: 0.00916 epssPercentile: 0.60007 exploits: github: 1 githubRepos: - 'https://github.com/0xBlackash/CVE-2026-63072' checkedAt: '2026-10-27T19:06:41.705Z' exploitAvailable: true --- ## Overview Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. ## Affected - `openssl >= 3.0.0, < 3.0.22` - `openssl >= 3.4.0, < 3.4.7` - `openssl >= 3.5.0, < 3.5.8` - `openssl >= 3.6.0, < 3.6.4` - `openssl >= 4.0.0, < 4.0.2` ## Remediation Upgrade past the affected range: - `openssl 4.0.2` ## Vendor advisories - **RHSA-2026:67154** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67154) - **RHSA-2026:67165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67165) - **RHSA-2026:59641** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59641) - **RHSA-2026:59635** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59635) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat Enterprise Linux 10, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63072.json) - **RHSA-2026:67956** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67956) - **RHSA-2026:71603** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71603) - **RHSA-2026:72475** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72475) - **RHSA-2026:72395** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72395) - **RHSA-2026:72399** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72399) - **RHSA-2026:72476** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72476) - **RHSA-2026:72470** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72470) - **RHSA-2026:72394** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72394) - **RHSA-2026:79357** · Red Hat · fixed in: Red Hat Cost Management On-Premise 1 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79357) - **RHSA-2026:79088** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79088) - **RHSA-2026:85249** · Red Hat · fixed in: Satellite Client 6 for RHEL 10, Satellite Client 6 for RHEL 7, Satellite Client 6 for RHEL 8, Satellite Client 6 for RHEL 9 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85249) - **RHSA-2026:89737** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89737) - **RHSA-2026:89736** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89736) - **RHSA-2026:89738** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89738) - **RHSA-2026:80514** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80514) - **RHSA-2026:85968** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85968) - **RHSA-2026:85970** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85970)