Quick answers
- Is CVE-2026-18798 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18798 being exploited in the wild.
- How severe is CVE-2026-18798?
- High severity, with a CVSS score of 7.5, published 25 August 2026.
- Which products and versions are affected?
- OpenSSL <UNKNOWN>.
- Is there a fix for CVE-2026-18798?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18798 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-18798?
- Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a double-free (CWE-415) in the port_default_packet_handler() function within OpenSSL's QUIC stack. When validating an initial QUIC packet, a QRX (QUIC record layer RX) object is created for validation. If validation succeeds but subsequent channel creation via port_bind_channel() fails—triggered by a malformed INITIAL packet with an invalid-length DCID (destination connection ID shorter than 8 bytes)—the QRX object is freed twice: once by port_bind_channel() on error and again by the default handler's error branch. Exploitation requires network-level access to send a non-RFC 9000 compliant QUIC INITIAL packet. The result is heap corruption and process termination (denial of service); remote code execution is considered highly improbable.
Affected products
- OpenSSL OpenSSL <UNKNOWN>
Timeline
- 2026-08-25: disclosed