CVE-2026-9076

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)<br /> processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK<br /> cipher can trigger a heap out-of-bounds read in kek_unwrap_key().<br /> <br /> Impact summary: A heap buffer over-read may trigger a crash which leads to<br /> Denial of Service for an application if the input buffer ends at a memory<br /> page boundary and the following page is unmapped. There is no information<br /> disclosure as the over-read bytes are not revealed to the attacker.<br /> <br /> The key unwrapping function performs a check-byte test as specified in the<br /> RFC that reads 7 bytes from a heap allocation that is based on the wrapped<br /> key length from the message. There is a minimum length check based on the<br /> block length of the wrapping cipher. However the cipher is selected from<br /> an OID carried in the attacker&amp;#39;s PWRI keyEncryptionAlgorithm with no<br /> requirement that the cipher be a block cipher. When an attacker selects<br /> a stream-mode cipher the guard will be ineffective and the allocated buffer<br /> containing the unwrapped key can be too small to fit the check-bytes<br /> specified in the RFC and a buffer over-read can happen.<br /> <br /> Applications calling CMS_decrypt() or CMS_decrypt_set1_password()<br /> (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS<br /> data are vulnerable to this issue. No password knowledge is required: the<br /> over-read happens during the unwrap attempt before any authentication<br /> succeeds.<br /> <br /> The over-read is limited to a few bytes and is not written to output, so<br /> there is no information disclosure. Triggering a crash requires the<br /> allocation to border unmapped memory, which is unlikely with the normal<br /> allocator.<br /> <br /> The FIPS modules are not affected by this issue.