Executive brief
OpenSSL is a widely used security library that provides encryption and secure communication for websites and applications. A flaw in how it handles certain signed data (PKCS#7) allows an attacker to crash an application by providing a specially crafted file. This results in a denial-of-service, meaning the affected service becomes unavailable to legitimate users.
Technical details
A type confusion vulnerability exists in the PKCS7_digest_from_attributes() function within OpenSSL. The root cause is the lack of type validation for the ASN1_TYPE union member when accessing message digest attributes. If the attribute type is not V_ASN1_OCTET_STRING, the library attempts to access invalid memory, leading to a NULL or invalid pointer dereference. An attacker can exploit this by providing a malformed signed PKCS#7 structure to an application that performs signature verification. This results in a Denial of Service (DoS) via application crash. The vulnerability affects multiple versions including 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1, and 1.0.2.
Affected products
- OpenSSL OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-01-27: advisory: OpenSSL Security Advisory published
- 2026-01-27: disclosed
References
- https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4
- https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49
- https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12
- https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e
- https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2
- https://openssl-library.org/news/secadv/20260127.txt
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html