Executive brief
OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A flaw in how it handles specific large data strings could allow an attacker to crash a service or potentially execute unauthorized code. However, this vulnerability is difficult to trigger in standard web traffic and typically requires a custom application to process unusually large amounts of malicious data.
Technical details
A signed integer overflow exists in ASN1_mbstring_copy() and ASN1_mbstring_ncopy() when calculating the destination buffer size for Unicode output (UTF-16, UTF-32, or UTF-8). When input exceeds approximately 2^30 characters, the size calculation can wrap to zero, leading to a one-byte allocation followed by a multi-gigabyte out-of-bounds write. While the theoretical impact includes remote code execution, the vulnerability is rated Low because standard X.509 certificate processing paths are protected by size limits and type masks. Exploitation requires an application to call the affected functions directly with attacker-controlled input exceeding 512MB.
Affected products
- OpenSSL Software Foundation OpenSSL All versions prior to fix (including 3.0, 3.4, 3.5, 3.6, 4.0)
Timeline
- 2026-06-09: advisory: Original advisory published by OpenSSL
References
- https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
- https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74
- https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974
- https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083
- https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
- https://openssl-library.org/news/secadv/20260609.txt