CVE-2026-7383

{"id": "CVE-2026-7383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7383", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "openssl-security@openssl.org", "affectedData": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.1", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.3", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.7", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.6", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.21", "versionType": "semver"}, {"status": "affected", "version": "1.1.1", "lessThan": "1.1.1zh", "versionType": "custom"}, {"status": "affected", "version": "1.0.2", "lessThan": "1.0.2zq", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T17:17:50.337", "references": [{"url": "https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://openssl-library.org/news/secadv/20260609.txt", "tags": ["Vendor Advisory"], "source": "openssl-security@openssl.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "openssl-security@openssl.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}, {"lang": "es", "value": "Resumen del problema: Un desbordamiento de entero con signo al dimensionar el b\u00fafer de destino para la salida Unicode en ASN1_mbstring_ncopy() puede conducir a un desbordamiento de b\u00fafer de pila.\n\nResumen del impacto: Un desbordamiento de b\u00fafer de pila puede conducir a un fallo o posiblemente a la ejecuci\u00f3n de c\u00f3digo controlado por el atacante u otro comportamiento indefinido.\n\nEn ASN1_mbstring_copy() y ASN1_mbstring_ncopy() el tama\u00f1o de destino para la salida Unicode se calcula en un entero con signo: mediante un desplazamiento a la izquierda del recuento de caracteres de entrada para BMPSTRING (UTF-16) y UNIVERSALSTRING (UTF-32), y sumando los recuentos de bytes por car\u00e1cter para UTF8STRING. El c\u00e1lculo desborda cuando la entrada alcanza alrededor de 2^30 caracteres. En el peor de los casos (UNIVERSALSTRING con 2^30 caracteres) el tama\u00f1o se ajusta a cero, se llama a OPENSSL_malloc(1), y la copia de caracteres subsiguiente escribe varios gigabytes m\u00e1s all\u00e1 de la asignaci\u00f3n de un byte.\n\nEl procesamiento de certificados X.509 se encamina a trav\u00e9s de ASN1_STRING_set_by_NID(), cuya m\u00e1scara DIRSTRING_TYPE excluye UNIVERSALSTRING y cuyos l\u00edmites de tama\u00f1o por NID restringen la longitud de entrada; ning\u00fan protocolo de red o ruta de manejo de certificados en OpenSSL ejerce el desbordamiento. Activar el error requiere una aplicaci\u00f3n que llama a ASN1_mbstring_copy() o ASN1_mbstring_ncopy() directamente, o registra un tipo de cadena personalizado a trav\u00e9s de ASN1_STRING_TABLE_add(), con entrada controlada por el atacante del orden de medio gigabyte o m\u00e1s. Por estas razones, a este problema se le asign\u00f3 una severidad Baja.\n\nLos m\u00f3dulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F534B804-67B6-49DA-8A86-0FF21E512908", "versionEndExcluding": "1.0.2zq", "versionStartIncluding": "1.0.2"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F", "versionEndExcluding": "1.1.1zh", "versionStartIncluding": "1.1.1"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB88756-EDFE-4886-A267-3F19342A6042", "versionEndExcluding": "3.0.21", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF7E21E7-AEC0-4882-B1F1-2D056B506F22", "versionEndExcluding": "3.4.6", "versionStartIncluding": "3.4.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A", "versionEndExcluding": "3.5.7", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F", "versionEndExcluding": "3.6.3", "versionStartIncluding": "3.6.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D"}], "operator": "OR"}]}], "sourceIdentifier": "openssl-security@openssl.org"}