CVE-2026-45784: rust-openssl heap overflow in CipherCtxRef::cipher_update_inplace

CVE-2026-45784 · Severity: medium · CVSS 4 · Published 2026-07-17

rust-openssl is a library that allows Rust applications to use OpenSSL for secure communications and data encryption. A flaw in how it handles specific AES encryption modes could allow an attacker to cause a program crash or potentially corrupt memory. This occurs when processing specially formatted data, which could impact the reliability and security of applications using these specific encryption features.

Technologies: openssl (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-45784 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45784 being exploited in the wild.
How severe is CVE-2026-45784?
Medium severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
openssl (crates.io) SEMVER:introduced=0.10.50,fixed=0.10.80; Rust-Openssl Openssl-Sys >= 0.10.50, < 0.10.80.
Is there a fix for CVE-2026-45784?
Yes. openssl (crates.io): upgrade to 0.10.80 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45784 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-45784?
Check whether you run openssl (crates.io) or Rust-Openssl Openssl-Sys at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openssl (crates.io): upgrade to 0.10.80 or later
    cargo update -p openssl

Technical details

An out-of-bounds write exists in the `CipherCtxRef::cipher_update_inplace` function within `openssl/src/cipher_ctx.rs`. The vulnerability is caused by an incorrect buffer size calculation when using AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). When provided with input that is not a multiple of 8 bytes, the library fails to account for the necessary padding, causing OpenSSL to write up to 7 bytes past the end of the allocated buffer. This results in heap corruption that may be controllable if an attacker can influence the plaintext length. The issue is fixed in version 0.10.80.

Affected products

  • rust-openssl rust-openssl >= 0.10.50, < 0.10.80

Identifiers

  • CVE-2026-45784
  • GHSA-phqj-4mhp-q6mq
  • RUSTSEC-2026-0477

Timeline

  • 2026-05-16: patched: Fix merged and version 0.10.80 released
  • 2026-05-16: advisory: GitHub Security Advisory GHSA-phqj-4mhp-q6mq published
  • 2026-07-17: disclosed: CVE-2026-45784 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.