CVE-2026-63072

Technical Description

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based

on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive

can write and cleanse more bytes than that query reports, causing an 8-byte

out-of-bounds heap write.

Impact summary: An attacker who supplies a crafted CMS message can trigger a

deterministic 8-byte out-of-bounds heap write when the victim decrypts it

with CMS_decrypt(), corrupting the heap and typically resulting in a Denial

of Service.

CWE: CWE-787: Out-of-bounds Write

Description: The key-wrap OID is potentially attacker-controlled on the wire.

CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.

An attacker can take a legitimate message and change a single OID byte to

select the padded variant while leaving the message otherwise valid. Since

the unwrap key is derived from the recipient's private operation (ECDH key

agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot

pass, and the decrypt

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References