# CVE-2026-41681: rust-openssl stack buffer overflow in MdCtxRef::digest_final

Source: https://junglewise.ai/threats/cve-2026-41681-rust-openssl-stack-buffer-overflow-in-mdctxref-digest-final  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-41681 · Severity: critical · CVSS 9.8 · Published 2026-04-24

rust-openssl is a library that allows Rust applications to use OpenSSL for secure communications and cryptography. A flaw in how the library handles message digests could allow an attacker to trigger a memory corruption, potentially leading to a complete system compromise or service crash. This issue is particularly significant because it can be triggered even when using the library's 'safe' programming interfaces.

Technologies: [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl), [Rust-Openssl Project Rust-Openssl](https://junglewise.ai/threats/technologies/rust-openssl). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Rust-Openssl Project](https://junglewise.ai/threats/vendors/rust-openssl-project).

## Quick answers

**Is CVE-2026-41681 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41681 being exploited in the wild.

**How severe is CVE-2026-41681?** Critical severity, with a CVSS score of 9.8, published 24 April 2026.

**Which products and versions are affected?** openssl (crates.io) SEMVER:introduced=0.10.39,fixed=0.10.78.

**Is there a fix for CVE-2026-41681?** Yes. openssl (crates.io): upgrade to 0.10.78 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41681 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41681?** Check whether you run openssl (crates.io) or Rust-Openssl Project Rust-Openssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl (crates.io): upgrade to 0.10.78 or later

  ```sh
  cargo update -p openssl
  ```


## Technical details

A stack-based buffer overflow exists in the rust-openssl library within the MdCtxRef::digest_final() function. The underlying OpenSSL EVP_DigestFinal() call writes a fixed number of bytes based on the context size without verifying that the provided Rust output buffer is large enough. Because this function is exposed to 'safe' Rust code, it bypasses typical memory safety guarantees, leading to stack corruption. An attacker who can influence the data being hashed or the expected digest size could potentially achieve remote code execution. The vulnerability is addressed in version 0.10.78 by adding a bounds check that returns an error if the output buffer is too small.

## Affected products

- rust-openssl project rust-openssl >= 0.10.39, < 0.10.78

## Identifiers

- CVE-2026-41681
- GHSA-ghm9-cr32-g9qj
- RUSTSEC-2026-0475

## Timeline

- 2026-04-19: patched: Fix merged into master and version 0.10.78 released
- 2026-04-19: advisory: GitHub Security Advisory GHSA-ghm9-cr32-g9qj published
- 2026-04-24: disclosed: CVE-2026-41681 published to NVD

## References

- [https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe](https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe)
- [https://github.com/rust-openssl/rust-openssl/pull/2608](https://github.com/rust-openssl/rust-openssl/pull/2608)
- [https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78](https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78)
- [https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qj](https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qj)

## Related threats

- [rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace](https://junglewise.ai/threats/cve-2026-45784-rust-openssl-heap-overflow-in-cipherctxref-cipher-update-inplace)
- [rust-openssl heap buffer overflow in AES key-wrap-with-padding](https://junglewise.ai/threats/cve-2026-44662-rust-openssl-heap-buffer-overflow-in-aes-key-wrap-with-padding)
- [rust-openssl undefined behavior in X509Ref::ocsp_responders](https://junglewise.ai/threats/cve-2026-42327-rust-openssl-undefined-behavior-in-x509ref-ocsp-responders)
- [rust-openssl buffer over-read in PSK and cookie callbacks](https://junglewise.ai/threats/cve-2026-41898-rust-openssl-buffer-over-read-in-psk-and-cookie-callbacks)
- [rust-openssl out-of-bounds write in aes::unwrap_key](https://junglewise.ai/threats/cve-2026-41678-rust-openssl-out-of-bounds-write-in-aes-unwrap-key)