Executive brief
rust-openssl is a library that allows Rust applications to use OpenSSL for secure communications and data encryption. A flaw in how it handles specific AES encryption modes could allow an attacker to cause a program crash or potentially corrupt memory. This occurs when processing specially formatted data, which could impact the reliability and security of applications using these specific encryption features.
Technical details
An out-of-bounds write exists in the `CipherCtxRef::cipher_update_inplace` function within `openssl/src/cipher_ctx.rs`. The vulnerability is caused by an incorrect buffer size calculation when using AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). When provided with input that is not a multiple of 8 bytes, the library fails to account for the necessary padding, causing OpenSSL to write up to 7 bytes past the end of the allocated buffer. This results in heap corruption that may be controllable if an attacker can influence the plaintext length. The issue is fixed in version 0.10.80.
Affected products
- rust-openssl rust-openssl >= 0.10.50, < 0.10.80
Timeline
- 2026-05-16: patched: Fix merged and version 0.10.80 released
- 2026-05-16: advisory: GitHub Security Advisory GHSA-phqj-4mhp-q6mq published
- 2026-07-17: disclosed: CVE-2026-45784 published to NVD
References
- https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7
- https://github.com/rust-openssl/rust-openssl/pull/2638
- https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.80
- https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq