Junglewise Threat Intelligence

CVE-2026-31789: OpenSSL heap buffer overflow in buf2hex conversion

CVE-2026-31789 · Severity: critical · CVSS 9.8 · Published 2026-04-07

Technologies: OpenSSL, Siemens SIMATIC CN 4100. Vendors: OpenSSL, Siemens.

Executive brief

OpenSSL is a widely used security library that helps protect internet communications. A vulnerability exists on 32-bit systems where processing an extremely large, specially crafted security certificate can cause the software to crash or potentially allow an attacker to take control of the system. While the risk is considered low because it requires a certificate larger than 1 Gigabyte, organizations using 32-bit applications that log or print certificate details should apply available updates.

Technical details

A heap buffer overflow exists in OpenSSL's buf2hexstr_sep function within crypto/o_str.c. When converting an OCTET STRING (such as those found in X.509 Subject Key Identifier or Authority Key Identifier extensions) to a hexadecimal string, the buffer size calculation involves multiplying the input length by 3. On 32-bit platforms, this multiplication can integer overflow, leading to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this by providing a crafted X.509 certificate exceeding 1GB in size to an application that prints or logs certificate contents. While the NVD CVSS score is 9.8, the vendor rates this as Low severity due to the impracticality of processing 1GB+ certificates and the limitation to 32-bit architectures. Patches are available in OpenSSL versions 3.6.2, 3.5.6, 3.4.5, 3.3.7, and 3.0.20.

Affected products

  • OpenSSL OpenSSL 3.6.0 to 3.6.1, 3.5.0 to 3.5.5, 3.4.0 to 3.4.4, 3.3.0 to 3.3.6, 3.0.0 to 3.0.19
  • Siemens SIMATIC CN 4100 versions prior to V5.0

Timeline

  • 2026-04-06: patched: Fixes committed to OpenSSL repository
  • 2026-04-07: advisory: OpenSSL Security Advisory published
  • 2026-04-07: disclosed: CVE-2026-31789 published to NVD

References

Related threats