A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.1. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.5. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.4. OpenSSL 3.3 users should upgrade to OpenSSL 3.3.6. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.19.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1472 https://access.redhat.com/errata/RHSA-2026:1472
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1473 https://access.redhat.com/errata/RHSA-2026:1473
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:1496 https://access.redhat.com/errata/RHSA-2026:1496
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1503 https://access.redhat.com/errata/RHSA-2026:1503
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:1519 https://access.redhat.com/errata/RHSA-2026:1519
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:1594 https://access.redhat.com/errata/RHSA-2026:1594
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:1733 https://access.redhat.com/errata/RHSA-2026:1733
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.20 Via RHSA-2026:2077 https://access.redhat.com/errata/RHSA-2026:2077
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:2072 https://access.redhat.com/errata/RHSA-2026:2072
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2026:2659 https://access.redhat.com/errata/RHSA-2026:2659
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:2633 https://access.redhat.com/errata/RHSA-2026:2633
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:2671 https://access.redhat.com/errata/RHSA-2026:2671
This issue has been addressed in the following products: Red Hat JBoss Core Services 2.4.62.SP3 Via RHSA-2026:2995 https://access.redhat.com/errata/RHSA-2026:2995
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2026:2974 https://access.redhat.com/errata/RHSA-2026:2974
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2026:3415 https://access.redhat.com/errata/RHSA-2026:3415
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2026:4419 https://access.redhat.com/errata/RHSA-2026:4419