# CVE-2026-31789: OpenSSL heap buffer overflow in buf2hex conversion

Source: https://junglewise.ai/threats/cve-2026-31789-openssl-heap-buffer-overflow-in-buf2hex-conversion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-31789 · Severity: critical · CVSS 9.8 · Published 2026-04-07

OpenSSL is a widely used security library that helps protect internet communications. A vulnerability exists on 32-bit systems where processing an extremely large, specially crafted security certificate can cause the software to crash or potentially allow an attacker to take control of the system. While the risk is considered low because it requires a certificate larger than 1 Gigabyte, organizations using 32-bit applications that log or print certificate details should apply available updates.

Technologies: [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-31789 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31789 being exploited in the wild.

**How severe is CVE-2026-31789?** Critical severity, with a CVSS score of 9.8, published 7 April 2026.

**Which products and versions are affected?** Siemens SIMATIC CN 4100 versions prior to V5.0.

**Is there a fix for CVE-2026-31789?** A patch was published on 2026-04-06: Fixes committed to OpenSSL repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31789 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-31789?** Check whether you run Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in OpenSSL's buf2hexstr_sep function within crypto/o_str.c. When converting an OCTET STRING (such as those found in X.509 Subject Key Identifier or Authority Key Identifier extensions) to a hexadecimal string, the buffer size calculation involves multiplying the input length by 3. On 32-bit platforms, this multiplication can integer overflow, leading to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this by providing a crafted X.509 certificate exceeding 1GB in size to an application that prints or logs certificate contents. While the NVD CVSS score is 9.8, the vendor rates this as Low severity due to the impracticality of processing 1GB+ certificates and the limitation to 32-bit architectures. Patches are available in OpenSSL versions 3.6.2, 3.5.6, 3.4.5, 3.3.7, and 3.0.20.

## Affected products

- OpenSSL OpenSSL 3.6.0 to 3.6.1, 3.5.0 to 3.5.5, 3.4.0 to 3.4.4, 3.3.0 to 3.3.6, 3.0.0 to 3.0.19
- Siemens SIMATIC CN 4100 versions prior to V5.0

## Timeline

- 2026-04-06: patched: Fixes committed to OpenSSL repository
- 2026-04-07: advisory: OpenSSL Security Advisory published
- 2026-04-07: disclosed: CVE-2026-31789 published to NVD

## References

- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)
- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)
- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)
- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)
- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)
- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)
- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)

## Related threats

- [Siemens SIMATIC CN 4100 resource exhaustion via TCP SYN flood](https://junglewise.ai/threats/cve-2026-22925-siemens-simatic-cn-4100-resource-exhaustion-via-tcp-syn-flood)
- [Siemens SIMATIC CN 4100 missing authentication and resource exhaustion](https://junglewise.ai/threats/cve-2026-22924-siemens-simatic-cn-4100-missing-authentication-and-resource)
- [Linux Kernel crypto algif_aead improper memory handling](https://junglewise.ai/threats/cve-2026-31431-linux-kernel-crypto-algif-aead-improper-memory-handling)
- [OpenSSL uninitialized memory disclosure in RSASVE key encapsulation](https://junglewise.ai/threats/cve-2026-31790-openssl-uninitialized-memory-disclosure-in-rsasve-key)
- [OpenSSL NULL pointer dereference in CMS EnvelopedData processing](https://junglewise.ai/threats/cve-2026-28390-openssl-null-pointer-dereference-in-cms-envelopeddata-processing)