Bug 2481895 (CVE-2026-42771)

Summary:	CVE-2026-42771 openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, csutherl, dpaolell, dsoumis, jclere, jdelft, jupierce, jwon, lgarciaa, mbiarnes, pjindal, plodge, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rmaucher, security-response-team, sghai, sidsharm, suppawar, szappis, vchlup, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenSSL. When an application uses the X509_VERIFY_PARAM_set1_email() function to validate a specially crafted S/MIME (Secure/Multipurpose Internet Mail Extensions) email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious email, leading to an application crash and a Denial of Service (DoS). This issue does not directly expose sensitive data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-07-10

Description OSIDB Bzimport 2026-05-27 14:21:33 UTC

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() (CVE-2026-42771)
Severity: Low

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an
application to validate a crafted e-mail address, such as during S/MIME
message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate
the data read to the attacker so the most likely result is a crash and
a Denial of Service.

An internal helper function called from X509_VERIFY_PARAM_[set|add]_email()
used a wrong length when validating the local part of an email address.
This could cause the 64 octet limit on the local part of an email address
to be not enforced, or cause an out of bound read and potentially a crash.

The bug is reachable via S-MIME validation with a crafted From: address
supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside
the OpenSSL FIPS module boundary.

OpenSSL 4.0 is vulnerable to this issue.

OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are not affected by this issue.

OpenSSL 4.0 users should upgrade to OpenSSL 4.0.1.

This issue was reported by TrendAI Zero Day Initiative on 16th April 2026.

The fix was developed by Bob Beck.