CVE-2026-9076: OpenSSL CMS Password Decryption Denial of Service

Technical summary

The vulnerability resides in the kek_unwrap_key() function, which implements RFC 3211 password-based CMS key unwrapping (PWRI). The function performs a check-byte validation that reads 7 bytes from an unwrapped key buffer. The buffer allocation size is based on the attacker-controlled wrapped key length, with a minimum size check that assumes a block cipher with a specific block length. However, the cipher algorithm is selected from an OID in the attacker's CMS message with no validation requiring it to be block-mode. By specifying a stream-mode cipher (which has different size semantics), an attacker can cause the allocated buffer to be insufficiently sized for the RFC-mandated check-byte read, resulting in a heap buffer over-read of several bytes beyond the allocation boundary. If the allocation borders an unmapped memory page, the over-read triggers a segmentation fault.

Business impact

Affected applications face potential service disruption. Any system processing untrusted CMS-encrypted messages via the CMS_decrypt() or CMS_decrypt_set1_password() APIs (or the openssl cms command-line tool) can be remotely crashed without authentication. This is particularly relevant for automated message processing, secure document handling, or secure email systems that rely on OpenSSL's CMS implementation. The attack requires no credentials or prior knowledge and can be conducted by any network-adjacent or remote attacker depending on deployment context. Recovery typically requires application restart.

Affected systems

OpenSSL is affected. Applications using OpenSSL's CMS decryption functions with untrusted input are vulnerable. This includes the openssl cms command-line utility when used with the -decrypt and -pwri_password options. The FIPS-validated OpenSSL modules are not affected. Deployments should verify their OpenSSL version against vendor advisories to determine if patches are available.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker crafts a CMS message with an attacker-chosen stream-mode cipher OID in the key encryption algorithm field, then sends it to a vulnerable application. No authentication, credentials, or password knowledge is required; the over-read occurs before authentication checks. Practical exploitation to trigger a crash depends on heap layout—the allocation must border unmapped memory for a segmentation fault. This is possible but not guaranteed with standard allocators. The attack vector is network-based with low complexity, making it a viable denial-of-service vector in exposed CMS processing services.

Remediation

Apply the patched OpenSSL version released by the OpenSSL project. Verify against the official OpenSSL security advisory for specific fixed versions. As a defensive measure, applications should avoid processing CMS messages from untrusted sources unless necessary; if processing is unavoidable, consider adding application-level validation to reject CMS messages using unexpected or stream-mode key encryption algorithms, or isolate CMS processing in a sandbox or containerized environment to limit blast radius of crashes. The FIPS modules do not require patching.

Patch guidance

Consult the OpenSSL project's official security advisory for CVE-2026-9076 to identify the fixed version(s) for your current OpenSSL release line (1.1.1, 3.0, 3.1, 3.2, etc.). Test the patched version in a development environment before deploying to production. Prioritize patching for systems that process untrusted CMS data or expose CMS decryption functionality via network APIs or command-line tools. For Linux distributions and other vendors shipping OpenSSL, check your package manager for available security updates.

Detection guidance

Monitor application logs for segmentation faults, core dumps, or unexpected crashes in processes running OpenSSL CMS decryption code. Intrusion detection systems with CMS message inspection capabilities may identify suspicious PWRI messages specifying unusual key encryption algorithm OIDs, particularly stream-mode ciphers. If the openssl cms command is exposed in scripts or services, audit its usage for potential untrusted input. Network-based detection is limited due to the encrypted nature of CMS payloads, but anomalous termination of otherwise stable services processing CMS data warrants investigation.

Why prioritize this

This vulnerability merits prompt patching despite its denial-of-service-only impact. It requires no authentication or user interaction, affects a widely deployed cryptographic library, and can be triggered remotely by any attacker capable of sending a crafted message to a vulnerable CMS processing service. The CVSS score of 7.5 (HIGH) reflects the low barrier to exploitation and the availability impact. Organizations operating automated message processing, email security gateways, or document encryption systems dependent on OpenSSL CMS should prioritize this patch.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by attack vector network, attack complexity low, and no privilege or user interaction required, combined with high availability impact. The confidentiality and integrity ratings are none because the over-read does not disclose data and does not enable corruption. The availability impact is high because a successful crash results in denial of service. The score appropriately reflects the severity of a remotely triggerable, unauthenticated denial-of-service condition in a cryptographic library, though practical exploitation for consistent crashing is mitigated by heap layout dependencies.

Frequently asked questions