# CVE-2026-41678: rust-openssl out-of-bounds write in aes::unwrap_key

Source: https://junglewise.ai/threats/cve-2026-41678-rust-openssl-out-of-bounds-write-in-aes-unwrap-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-41678 · Severity: high · CVSS 8.1 · Published 2026-04-24

rust-openssl is a library that allows Rust applications to use OpenSSL for secure communications and data encryption. A flaw in its AES key wrapping component could allow an attacker to cause a memory error by providing specifically sized data buffers. This could lead to application crashes or potentially allow unauthorized access to sensitive information.

Technologies: [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl), [Rust-Openssl Project Rust-Openssl](https://junglewise.ai/threats/technologies/rust-openssl). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Rust-Openssl Project](https://junglewise.ai/threats/vendors/rust-openssl-project).

## Quick answers

**Is CVE-2026-41678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41678 being exploited in the wild.

**How severe is CVE-2026-41678?** High severity, with a CVSS score of 8.1, published 24 April 2026.

**Which products and versions are affected?** openssl (crates.io) SEMVER:introduced=0.10.24,fixed=0.10.78.

**Is there a fix for CVE-2026-41678?** Yes. openssl (crates.io): upgrade to 0.10.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41678 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41678?** Check whether you run openssl (crates.io) or Rust-Openssl Project Rust-Openssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl (crates.io): upgrade to 0.10.78 or later

  ```sh
  cargo update -p openssl
  ```


## Technical details

An out-of-bounds write vulnerability exists in the aes::unwrap_key() function of rust-openssl due to an inverted bounds check assertion. The function incorrectly validates the output buffer size using 'out.len() + 8 <= in_.len()' instead of ensuring the buffer is large enough ('out.len() >= in_.len() - 8'). Consequently, the function rejects sufficiently large buffers and accepts those that are too small, leading to a memory write past the end of the buffer. This can be triggered via network-reachable vectors if an application allows attacker-controlled buffer sizes. The issue is fixed in version 0.10.78.

## Affected products

- rust-openssl project rust-openssl >= 0.10.24, < 0.10.78

## Identifiers

- CVE-2026-41678
- GHSA-8c75-8mhr-p7r9
- RUSTSEC-2026-0463

## Timeline

- 2026-04-19: advisory: GitHub security advisory published
- 2026-04-24: disclosed: CVE published to NVD

## References

- [https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-8c75-8mhr-p7r9](https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-8c75-8mhr-p7r9)

## Related threats

- [rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace](https://junglewise.ai/threats/cve-2026-45784-rust-openssl-heap-overflow-in-cipherctxref-cipher-update-inplace)
- [rust-openssl heap buffer overflow in AES key-wrap-with-padding](https://junglewise.ai/threats/cve-2026-44662-rust-openssl-heap-buffer-overflow-in-aes-key-wrap-with-padding)
- [rust-openssl undefined behavior in X509Ref::ocsp_responders](https://junglewise.ai/threats/cve-2026-42327-rust-openssl-undefined-behavior-in-x509ref-ocsp-responders)
- [rust-openssl buffer over-read in PSK and cookie callbacks](https://junglewise.ai/threats/cve-2026-41898-rust-openssl-buffer-over-read-in-psk-and-cookie-callbacks)
- [rust-openssl stack buffer overflow in MdCtxRef::digest_final](https://junglewise.ai/threats/cve-2026-41681-rust-openssl-stack-buffer-overflow-in-mdctxref-digest-final)