Is CVE-2026-41681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41681 being exploited in the wild.

How severe is CVE-2026-41681?

Critical severity, with a CVSS score of 9.8, published 24 April 2026.

Which products and versions are affected?

openssl (crates.io) SEMVER:introduced=0.10.39,fixed=0.10.78.

Is there a fix for CVE-2026-41681?

Yes. openssl (crates.io): upgrade to 0.10.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41681?

Check whether you run openssl (crates.io) or Rust-Openssl Project Rust-Openssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41681: rust-openssl stack buffer overflow in MdCtxRef::digest_final

CVE-2026-41681 · Severity: critical · CVSS 9.8 · Published 2026-04-24

rust-openssl is a library that allows Rust applications to use OpenSSL for secure communications and cryptography. A flaw in how the library handles message digests could allow an attacker to trigger a memory corruption, potentially leading to a complete system compromise or service crash. This issue is particularly significant because it can be triggered even when using the library's 'safe' programming interfaces.

Technologies: openssl (crates.io), Rust-Openssl Project Rust-Openssl. Vendors: crates.io, Rust-Openssl Project.

Quick answers

Is CVE-2026-41681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41681 being exploited in the wild.
How severe is CVE-2026-41681?: Critical severity, with a CVSS score of 9.8, published 24 April 2026.
Which products and versions are affected?: openssl (crates.io) SEMVER:introduced=0.10.39,fixed=0.10.78.
Is there a fix for CVE-2026-41681?: Yes. openssl (crates.io): upgrade to 0.10.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41681?: Check whether you run openssl (crates.io) or Rust-Openssl Project Rust-Openssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl (crates.io): upgrade to 0.10.78 or later
```
cargo update -p openssl
```

Technical details

A stack-based buffer overflow exists in the rust-openssl library within the MdCtxRef::digest_final() function. The underlying OpenSSL EVP_DigestFinal() call writes a fixed number of bytes based on the context size without verifying that the provided Rust output buffer is large enough. Because this function is exposed to 'safe' Rust code, it bypasses typical memory safety guarantees, leading to stack corruption. An attacker who can influence the data being hashed or the expected digest size could potentially achieve remote code execution. The vulnerability is addressed in version 0.10.78 by adding a bounds check that returns an error if the output buffer is too small.

Affected products

rust-openssl project rust-openssl >= 0.10.39, < 0.10.78

Identifiers

CVE-2026-41681
GHSA-ghm9-cr32-g9qj
RUSTSEC-2026-0475

Timeline

2026-04-19: patched: Fix merged into master and version 0.10.78 released
2026-04-19: advisory: GitHub Security Advisory GHSA-ghm9-cr32-g9qj published
2026-04-24: disclosed: CVE-2026-41681 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.