CVE-2026-9076

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9076", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-05-20T12:43:37.677Z", "datePublished": "2026-06-09T16:03:16.306Z", "dateUpdated": "2026-06-10T07:47:51.139Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.7", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.6", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.0.21", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "1.1.1zh", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.0.2zq", "status": "affected", "version": "1.0.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Bhabani Sankar Das"}, {"lang": "en", "type": "reporter", "value": "Haruki Oyama (Waseda University)"}, {"lang": "en", "type": "remediation developer", "value": "Nikola Pajkovsky"}], "datePublic": "2026-06-09T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)<br>processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK<br>cipher can trigger a heap out-of-bounds read in kek_unwrap_key().<br><br>Impact summary: A heap buffer over-read may trigger a crash which leads to<br>Denial of Service for an application if the input buffer ends at a memory<br>page boundary and the following page is unmapped. There is no information<br>disclosure as the over-read bytes are not revealed to the attacker.<br><br>The key unwrapping function performs a check-byte test as specified in the<br>RFC that reads 7 bytes from a heap allocation that is based on the wrapped<br>key length from the message. There is a minimum length check based on the<br>block length of the wrapping cipher. However the cipher is selected from<br>an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no<br>requirement that the cipher be a block cipher. When an attacker selects<br>a stream-mode cipher the guard will be ineffective and the allocated buffer<br>containing the unwrapped key can be too small to fit the check-bytes<br>specified in the RFC and a buffer over-read can happen.<br><br>Applications calling CMS_decrypt() or CMS_decrypt_set1_password()<br>(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS<br>data are vulnerable to this issue. No password knowledge is required: the<br>over-read happens during the unwrap attempt before any authentication<br>succeeds.<br><br>The over-read is limited to a few bytes and is not written to output, so<br>there is no information disclosure. Triggering a crash requires the<br>allocation to border unmapped memory, which is unlikely with the normal<br>allocator.<br><br>The FIPS modules are not affected by this issue."}], "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:47:51.139Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}, {"name": "4.0.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0"}, {"name": "3.6.3 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26"}, {"name": "3.5.7 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98"}, {"name": "3.4.6 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb"}, {"name": "3.0.21 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"}], "source": {"discovery": "UNKNOWN"}, "title": "Out-of-Bounds Read in CMS Password-Based Decryption", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T19:04:07.840133Z", "id": "CVE-2026-9076", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T19:04:20.258Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-9076", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T19:04:07.840133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T19:04:03.021Z"}}], "cna": {"title": "Out-of-Bounds Read in CMS Password-Based Decryption", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Bhabani Sankar Das"}, {"lang": "en", "type": "reporter", "value": "Haruki Oyama (Waseda University)"}, {"lang": "en", "type": "remediation developer", "value": "Nikola Pajkovsky"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Low"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.1", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.3", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.7", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.6", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.21", "versionType": "semver"}, {"status": "affected", "version": "1.1.1", "lessThan": "1.1.1zh", "versionType": "custom"}, {"status": "affected", "version": "1.0.2", "lessThan": "1.0.2zq", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T14:00:00.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260609.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0", "name": "4.0.1 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26", "name": "3.6.3 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98", "name": "3.5.7 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb", "name": "3.4.6 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6", "name": "3.0.21 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)<br>processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK<br>cipher can trigger a heap out-of-bounds read in kek_unwrap_key().<br><br>Impact summary: A heap buffer over-read may trigger a crash which leads to<br>Denial of Service for an application if the input buffer ends at a memory<br>page boundary and the following page is unmapped. There is no information<br>disclosure as the over-read bytes are not revealed to the attacker.<br><br>The key unwrapping function performs a check-byte test as specified in the<br>RFC that reads 7 bytes from a heap allocation that is based on the wrapped<br>key length from the message. There is a minimum length check based on the<br>block length of the wrapping cipher. However the cipher is selected from<br>an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no<br>requirement that the cipher be a block cipher. When an attacker selects<br>a stream-mode cipher the guard will be ineffective and the allocated buffer<br>containing the unwrapped key can be too small to fit the check-bytes<br>specified in the RFC and a buffer over-read can happen.<br><br>Applications calling CMS_decrypt() or CMS_decrypt_set1_password()<br>(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS<br>data are vulnerable to this issue. No password knowledge is required: the<br>over-read happens during the unwrap attempt before any authentication<br>succeeds.<br><br>The over-read is limited to a few bytes and is not written to output, so<br>there is no information disclosure. Triggering a crash requires the<br>allocation to border unmapped memory, which is unlikely with the normal<br>allocator.<br><br>The FIPS modules are not affected by this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:47:51.139Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9076", "state": "PUBLISHED", "dateUpdated": "2026-06-10T07:47:51.139Z", "dateReserved": "2026-05-20T12:43:37.677Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-06-09T16:03:16.306Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.7", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.6", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.0.21", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "1.1.1zh", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.0.2zq", "status": "affected", "version": "1.0.2", "versionType": "custom"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "F534B804-67B6-49DA-8A86-0FF21E512908", "versionEndExcluding": "1.0.2zq", "versionStartIncluding": "1.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F", "versionEndExcluding": "1.1.1zh", "versionStartIncluding": "1.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "EDB88756-EDFE-4886-A267-3F19342A6042", "versionEndExcluding": "3.0.21", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF7E21E7-AEC0-4882-B1F1-2D056B506F22", "versionEndExcluding": "3.4.6", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A", "versionEndExcluding": "3.5.7", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F", "versionEndExcluding": "3.6.3", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}, {"lang": "es", "value": "Resumen del problema: Cuando el descifrado basado en contrase\u00f1a de CMS (RFC 3211 / desenvolvimiento de clave PWRI) procesa datos CMS suministrados por el atacante, un cifrado KEK en modo de flujo elegido por el atacante puede desencadenar una lectura fuera de l\u00edmites en el heap en kek_unwrap_key().\n\nResumen del impacto: Una lectura excesiva del b\u00fafer del heap puede desencadenar un fallo que lleva a la denegaci\u00f3n de servicio para una aplicaci\u00f3n si el b\u00fafer de entrada termina en un l\u00edmite de p\u00e1gina de memoria y la p\u00e1gina siguiente no est\u00e1 mapeada. No hay revelaci\u00f3n de informaci\u00f3n ya que los bytes le\u00eddos en exceso no se revelan al atacante.\n\nLa funci\u00f3n de desenvolvimiento de clave realiza una prueba de bytes de verificaci\u00f3n seg\u00fan lo especificado en el RFC que lee 7 bytes de una asignaci\u00f3n en el heap que se basa en la longitud de la clave envuelta del mensaje. Hay una verificaci\u00f3n de longitud m\u00ednima basada en la longitud de bloque del cifrado de envoltura. Sin embargo, el cifrado se selecciona de un OID transportado en el algoritmo de cifrado de clave PWRI del atacante sin el requisito de que el cifrado sea un cifrado de bloque. Cuando un atacante selecciona un cifrado en modo de flujo, la protecci\u00f3n ser\u00e1 ineficaz y el b\u00fafer asignado que contiene la clave desenvuelta puede ser demasiado peque\u00f1o para contener los bytes de verificaci\u00f3n especificados en el RFC y puede ocurrir una lectura excesiva del b\u00fafer.\n\nLas aplicaciones que llaman a 'CMS_decrypt()' o 'CMS_decrypt_set1_password()' (equivalentemente OpenSSL cms -decrypt -pwri_password ...) en datos CMS no confiables son vulnerables a este problema. No se requiere conocimiento de la contrase\u00f1a: la lectura excesiva ocurre durante el intento de desenvolvimiento antes de que cualquier autenticaci\u00f3n tenga \u00e9xito.\n\nLa lectura excesiva est\u00e1 limitada a unos pocos bytes y no se escribe en la salida, por lo que no hay revelaci\u00f3n de informaci\u00f3n. Desencadenar un fallo requiere que la asignaci\u00f3n limite con memoria no mapeada, lo cual es poco probable con el asignador normal.\n\nLos m\u00f3dulos FIPS no se ven afectados por este problema."}], "id": "CVE-2026-9076", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9076", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T19:04:07.840133Z", "version": "2.0.3"}}]}, "published": "2026-06-09T17:17:50.997", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "id": "2481880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\nThe FIPS modules are not affected by this issue.", "A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax (CMS) data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key (KEK) cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leading to a Denial of Service (DoS). This vulnerability does not require password knowledge and can be exploited before authentication."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-9076", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "ovmf", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "compat-openssl10", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mingw-openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "compat-openssl11", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-9076\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-9076"], "statement": "This is a Low impact denial of service due to a heap out-of-bounds read in `kek_unwrap_key()` when processing attacker-supplied CMS data with an attacker-chosen stream-mode KEK cipher. This flaw requires specific memory conditions (input buffer ending at a page boundary with an unmapped following page) to trigger a crash, which is uncommon in typical Red Hat environments. No information disclosure is possible, and FIPS modules are not affected.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.1.1,1.1.1zh)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.2,1.0.2zq)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-06-09T17:45:09.854046+00:00", "updated": "2026-06-11T02:30:02.689609+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}