CVE-2026-9076

Technical Description

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)

processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK

cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

Impact summary: A heap buffer over-read may trigger a crash which leads to

Denial of Service for an application if the input buffer ends at a memory

page boundary and the following page is unmapped. There is no information

disclosure as the over-read bytes are not revealed to the attacker.

The key unwrapping function performs a check-byte test as specified in the

RFC that reads 7 bytes from a heap allocation that is based on the wrapped

key length from the message. There is a minimum length check based on the

block length of the wrapping cipher. However the cipher is selected from

an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no

requirement that the cipher be a block cipher. When an attacker selects

a stream-mode cipher the guard will be ineffective

Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References