Heap Buffer Overflow in CMS Key Unwrapping (CVE-2026-63072)

What is affected, what to do

A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt().

An exploit is publicly available. Update OpenSSL to version 4.0.2, OpenSSL to version 3.6.4, OpenSSL to version 3.5.8.

Affected

• OpenSSL lt 4.0.0..4.0.2
• OpenSSL lt 3.6.0..3.6.4
• OpenSSL lt 3.5.0..3.5.8
• OpenSSL lt 3.4.0..3.4.7
• OpenSSL lt 3.0.0..3.0.22
• OpenSSL lt 1.1.1..1.1.1zi

Fixed in

• OpenSSL 4.0.2
• OpenSSL 3.6.4
• OpenSSL 3.5.8
• OpenSSL 3.4.7
• OpenSSL 3.0.22
• OpenSSL 1.1.1zi

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.

Source: redhat_csaf, Ubuntu Security Notices, suse_csaf, Debian Security Advisories, Debian LTS Advisories, BSI WID Portal, BSI CSAF, NVD (NIST), cvelistv5, Microsoft Security Update Guide

Vendors and products

• Debian Openssl
• Freebsd Project Freebsd OS
• Meinberg Lantime
• Open Source Openssl
• OpenSSL OpenSSL
• Ubuntu Openssl

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• openssl-library.orgOpenSSL AdvisoryVendor advisory
• github.com4.0.2 git commitPatch
• github.com3.6.4 git commitPatch
• github.com3.5.8 git commitPatch
• github.com3.4.7 git commitPatch
• github.com3.0.22 git commitPatch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 11.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • OpenSSL (3.5.0 – before 3.5.8; 3.6.0 – before 3.6.4; 4.0.0 – before 4.0.2; 3.4.0 – before 3.4.7; 3.0.0 – before 3.0.22)

   New references:

   • https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756
   • https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42
   • https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335
   • https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a

   and 2 more references

   Show 7 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.8 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.4 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.0.2 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.7 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.22
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260825.txt Types: Vendor Advisory

   Source identifier: nvd@nist.gov

2. 25.08.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
   SSVC assessment	added	—	{"id":"CVE-2026-63072","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T14:29:50.344129Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 25.08.2026Receivedopenssl.org

   Weakness type: CWE-787

   Description added or changed

   New references:

   • https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756
   • https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42
   • https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335
   • https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a

   and 2 more references

   Show 9 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	OpenSSL
   Description	added	—	Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
   Weakness type (CWE)	added	—	CWE-787
   Reference	added	—	https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756
   Reference	added	—	https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42
   Reference	added	—	https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335
   Reference	added	—	https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a
   Reference	added	—	https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
   Reference	added	—	https://openssl-library.org/news/secadv/20260825.txt

   Source identifier: openssl-security@openssl.org