Catalogo CVE

CVE-2026-9076

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in

[Catalogo CVE]

Gravità: High · CVSS 7.5
Published: Jun 9, 2026, 5:17:50 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.71% · Oct 22, 2026

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker. The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen. Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds. The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator. The FIPS modules are not affected by this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	fixed
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	fixed
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	fixed
Debian	openssl	bookworm-security	`3.0.22-1~deb12u1`	fixed
Cpe	openssl	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl-dev	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl-doc	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	libssl3t64	Not reported	`3.0.13-0ubuntu3.11`	fixed
Cpe	openssl	Not reported	`1.0.2zq`	fixed
Cpe	openssl	Not reported	`1.1.1zh`	fixed
Cpe	openssl	Not reported	`3.0.21`	fixed
Cpe	openssl	Not reported	`3.4.6`	fixed
Cpe	openssl	Not reported	`3.5.7`	fixed
Cpe	openssl	Not reported	`3.6.3`	fixed
Cpe	openssl	Not reported	Not reported	unknown
Cpe	openssl	Not reported	`3.0.20-1~deb12u2`	fixed
Alpine	openssl	3.21	`3.3.7-r1`	fixed
Alpine	openssl	3.22	`3.5.7-r0`	fixed
Alpine	openssl	3.23	`3.5.7-r0`	fixed
Alpine	openssl	3.24	`3.5.7-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	forky	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	trixie	`3.5.6-1~deb13u2`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	bookworm	`3.0.20-1~deb12u2`	not yet assigned	Not reported	[1139674]
Cpe	openssl	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl-dev	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl-doc	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	libssl3t64	cpe	Not reported	`3.0.13-0ubuntu3.11`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`1.0.2zq`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`1.1.1zh`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.0.21`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.4.6`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.5.7`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.6.3`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`3.0.20-1~deb12u2`	Not reported	Not reported	Not reported
Alpine	openssl	apk	3.21	`3.3.7-r1`	Not reported	ALPINE-CVE-2026-9076	Not reported
Alpine	openssl	apk	3.22	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-9076	Not reported
Alpine	openssl	apk	3.23	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-9076	Not reported
Alpine	openssl	apk	3.24	`3.5.7-r0`	Not reported	ALPINE-CVE-2026-9076	Not reported

[Debian bug #1139674]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libssl3]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-dev]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[libssl-doc]Interessata
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
[openssl]Interessata
Dettagli (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Interessata · Corretta: 3.0.20-1~deb12u2
  nvd · openssl · debian · bookworm; nvd · openssl · debian · 12

[Debian 13 (Trixie)]

[libssl3t64]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[libssl-dev]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[libssl-doc]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · all · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · all · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl]Corretta
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-fips]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
[openssl-provider-legacy]Corretta
Pacchetto sorgente: [openssl]
Dettagli (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Corretta · Corretta: 3.5.6-1~deb13u2
  nvd · openssl · debian · 13

Osservato: Oct 23, 2026, 9:46:27 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]