CVE-2026-63072

*** Pendiente de traducción *** Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based<br /> on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive<br /> can write and cleanse more bytes than that query reports, causing an 8-byte<br /> out-of-bounds heap write.<br /> <br /> Impact summary: An attacker who supplies a crafted CMS message can trigger a<br /> deterministic 8-byte out-of-bounds heap write when the victim decrypts it<br /> with CMS_decrypt(), corrupting the heap and typically resulting in a Denial<br /> of Service.<br /> <br /> CWE: CWE-787: Out-of-bounds Write<br /> <br /> Description: The key-wrap OID is potentially attacker-controlled on the wire.<br /> CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.<br /> An attacker can take a legitimate message and change a single OID byte to<br /> select the padded variant while leaving the message otherwise valid. Since<br /> the unwrap key is derived from the recipient&amp;#39;s private operation (ECDH key<br /> agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot<br /> pass, and the decryption fails with integrity failure.<br /> <br /> The write is a fixed-size (8-byte), fixed-value (zero) heap overflow<br /> immediately past the allocation, requires no special configuration, and is<br /> reachable from the public CMS_decrypt() function. The consequence is<br /> a heap corruption leading to a Denial of Service. The fix in the CMS code<br /> sizes the unwrap output buffer for the worst case so a failed unwrap cannot<br /> write past the allocation.<br /> <br /> FIPS impact: no<br /> <br /> As the CMS code lives outside the FIPS module boundary, no FIPS<br /> modules are affected by this CVE.