Is CVE-2026-7383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7383 being exploited in the wild.

How severe is CVE-2026-7383?

High severity, with a CVSS score of 8.1, published 9 June 2026.

Which products and versions are affected?

OpenSSL Software Foundation OpenSSL All versions prior to fix (including 3.0, 3.4, 3.5, 3.6, 4.0).

Is there a fix for CVE-2026-7383?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7383 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7383?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7383: OpenSSL heap buffer overflow in ASN1_mbstring_ncopy

CVE-2026-7383 · Severity: high · CVSS 8.1 · Published 2026-06-09

OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A flaw in how it handles specific large data strings could allow an attacker to crash a service or potentially execute unauthorized code. However, this vulnerability is difficult to trigger in standard web traffic and typically requires a custom application to process unusually large amounts of malicious data.

Quick answers

Is CVE-2026-7383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7383 being exploited in the wild.
How severe is CVE-2026-7383?: High severity, with a CVSS score of 8.1, published 9 June 2026.
Which products and versions are affected?: OpenSSL Software Foundation OpenSSL All versions prior to fix (including 3.0, 3.4, 3.5, 3.6, 4.0).
Is there a fix for CVE-2026-7383?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7383 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7383?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A signed integer overflow exists in ASN1_mbstring_copy() and ASN1_mbstring_ncopy() when calculating the destination buffer size for Unicode output (UTF-16, UTF-32, or UTF-8). When input exceeds approximately 2^30 characters, the size calculation can wrap to zero, leading to a one-byte allocation followed by a multi-gigabyte out-of-bounds write. While the theoretical impact includes remote code execution, the vulnerability is rated Low because standard X.509 certificate processing paths are protected by size limits and type masks. Exploitation requires an application to call the affected functions directly with attacker-controlled input exceeding 512MB.

Affected products

OpenSSL Software Foundation OpenSSL All versions prior to fix (including 3.0, 3.4, 3.5, 3.6, 4.0)

Timeline

2026-06-09: advisory: Original advisory published by OpenSSL

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.