Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw was found in OpenSSL. OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:67154 https://access.redhat.com/errata/RHSA-2026:67154
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:67165 https://access.redhat.com/errata/RHSA-2026:67165
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:80514 https://access.redhat.com/errata/RHSA-2026:80514
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:85970 https://access.redhat.com/errata/RHSA-2026:85970
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:85968 https://access.redhat.com/errata/RHSA-2026:85968
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:89737 https://access.redhat.com/errata/RHSA-2026:89737
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:89736 https://access.redhat.com/errata/RHSA-2026:89736
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:89738 https://access.redhat.com/errata/RHSA-2026:89738
This issue has been addressed in the following products: Red Hat Satellite 6.18 for RHEL 9 Via RHSA-2026:92860 https://access.redhat.com/errata/RHSA-2026:92860
This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:92858 https://access.redhat.com/errata/RHSA-2026:92858
This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:92859 https://access.redhat.com/errata/RHSA-2026:92859
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.22 Via RHSA-2026:95346 https://access.redhat.com/errata/RHSA-2026:95346
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:96216 https://access.redhat.com/errata/RHSA-2026:96216