CVE-2026-63072: OpenSSL CMS Decryption DOS Vulnerability

CVE-2026-63072 Overview

CVE-2026-63072 is an out-of-bounds heap write vulnerability [CWE-787] in OpenSSL's Cryptographic Message Syntax (CMS) decryption code. The CMS layer sizes the key-unwrap output buffer based on the unwrapped key size query, but the AES-WRAP-PAD primitive can write and cleanse more bytes than that query reports. This results in a deterministic 8-byte, zero-valued heap overflow past the allocation. An attacker who supplies a crafted CMS message triggers the write when the victim calls CMS_decrypt(). The corruption typically produces a Denial of Service condition.

Critical Impact
A single-byte OID modification on the wire converts a legitimate CMS message into a payload that triggers a deterministic heap corruption in any application that decrypts it with CMS_decrypt().

Affected Products

OpenSSL CMS implementation (crypto/cms/cms_kari.c)
OpenSSL CMS KEM Recipient Info handler (crypto/cms/cms_kemri.c)
Applications invoking CMS_decrypt() on attacker-supplied messages

Discovery Timeline

2026-08-25 - OpenSSL Security Advisory 20260825 released
2026-08-25 - CVE-2026-63072 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-63072

Vulnerability Analysis

The defect lives in the CMS key-agreement recipient handling paths. CMS unwrapping accepts both id-aesNNN-wrap and id-aesNNN-wrap-pad ciphers, and the key-wrap Object Identifier (OID) is attacker-controlled on the wire. An attacker takes a legitimate CMS message and flips a single OID byte to select the padded variant. The CMS code allocates an output buffer sized to the reported unwrapped key length. However, the RFC 5649 AES-WRAP-PAD primitive writes and later zeroes a length aligned to the AES block boundary. This mismatch produces an 8-byte write immediately past the allocation.

Root Cause

The CMS layer queries the expected unwrapped key size to size the destination buffer. That query does not account for the block-aligned working size that AES-WRAP-PAD uses internally during the integrity check and cleanse step. Because the unwrap key is derived from the recipient's private operation via Elliptic Curve Diffie-Hellman (ECDH) or ML-KEM decapsulation, the RFC 5649 integrity check fails. The failure path still executes the out-of-bounds cleanse before returning the error.

Attack Vector

The write is fixed-size (8 bytes), fixed-value (zero), and reachable from the public CMS_decrypt() API. No special configuration is required. The attacker needs the ability to deliver a modified CMS message that the victim decrypts. FIPS modules are not affected because the CMS code lives outside the FIPS module boundary.

// Patched allocation in crypto/cms/cms_kari.c
     unsigned char *out = NULL;
     size_t out_alloc_len = 0;
     int outlen;
+    size_t outsize;
 
     keklen = EVP_CIPHER_CTX_get_key_length(kari->ctx);
     if (keklen > EVP_MAX_KEY_LENGTH || inlen > INT_MAX)
// Source: https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756

The fix introduces an outsize variable so the CMS code sizes the unwrap output buffer for the worst case. A failed unwrap can no longer write past the allocation. The parallel change in crypto/cms/cms_kemri.c applies the same worst-case sizing to the KEM Recipient Info decryption path.

Detection Methods for CVE-2026-63072

Indicators of Compromise

Unexpected crashes or heap corruption abort signals in processes that call CMS_decrypt(), particularly mail gateways, S/MIME clients, and PKI services.
CMS messages where the KeyEncryptionAlgorithm OID selects id-aesNNN-wrap-pad while the rest of the message matches a previously observed legitimate structure.
Repeated CMS_R_UNWRAP_FAILURE or integrity-check-failure entries in application error logs preceding process termination.

Detection Strategies

Inspect CMS/S/MIME traffic at gateways for messages using id-aesNNN-wrap-pad in KeyAgreeRecipientInfo or KEMRecipientInfo structures and flag anomalous frequencies.
Monitor process crash telemetry on hosts running OpenSSL-linked services for heap corruption signatures correlated with CMS decryption calls.
Correlate ECDH or ML-KEM recipient processing errors with subsequent memory allocator diagnostics.

Monitoring Recommendations

Enable Address Sanitizer or heap-hardening allocators in test environments to surface the 8-byte write during regression testing.
Log and alert on repeated CMS_decrypt() integrity failures from the same sender or channel.
Track OpenSSL library versions across the fleet to identify unpatched hosts running CMS-consuming applications.

How to Mitigate CVE-2026-63072

Immediate Actions Required

Inventory all applications that call CMS_decrypt() or process S/MIME content, including mail servers, code-signing services, and PKI infrastructure.
Upgrade OpenSSL to a version containing the fixes referenced in the OpenSSL Security Advisory 20260825.
Restart long-running services that link against OpenSSL after the library is updated.

Patch Information

OpenSSL published fixes across five commits: 2a3dac874c, 87784ad619a, 9530a5fd1a, 9ec2f6d2ae, and a0c8ec557d9. The fixes size the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. See the OpenSSL Security Advisory 20260825 for release-branch mapping.

Workarounds

Restrict CMS decryption to messages from trusted senders where the transport channel is authenticated and integrity-protected.
Where feasible, disable acceptance of id-aesNNN-wrap-pad OIDs at application-level filters until the OpenSSL update is deployed.
Run CMS-consuming services under process isolation or restart supervisors so that a heap-corruption crash does not cascade into extended downtime.

bash

# Verify installed OpenSSL version and rebuild dependent services
openssl version -a
ldconfig -p | grep -E 'libssl|libcrypto'
systemctl restart postfix dovecot nginx