CVE-2026-41676

What it actually does

CVE-2026-41676 is a memory corruption flaw in the Rust `openssl` crate’s key-derivation APIs. In versions 0.9.27 through 0.10.77, `Deriver::derive` and `PkeyCtxRef::derive` pass the caller-provided output buffer length to OpenSSL as an in/out parameter, assuming OpenSSL will respect the buffer size. With OpenSSL 1.1.x, several derivation implementations, including X25519, X448, DH, and HKDF-extract, ignore the incoming length and write the full derived secret instead. If an application provides a shorter slice, this can cause a heap or stack buffer overflow from otherwise safe Rust code. The issue is specific to use with older OpenSSL 1.1.x behavior; OpenSSL 3.x providers perform the expected bounds check.

Why it matters to the business

Applications built with affected rust-openssl versions and linked against OpenSSL 1.1.x may be vulnerable to crashes, denial of service, or potentially arbitrary memory corruption when cryptographic derivation routines are reachable through attacker-controlled workflows such as handshakes, key exchange, token processing, or encrypted protocol handling. The CVSS score is critical, but currently there is no CISA KEV listing, no ransomware association, no public exploit maturity, and EPSS is low and flat at approximately 0.0028 over 30 days, so immediate risk depends heavily on whether exposed services use the affected APIs with undersized buffers.

How an attack unfolds

An attacker first identifies a service or library component written in Rust that depends on the affected `openssl` crate and is linked to OpenSSL 1.1.x. The vulnerable code must call `Deriver::derive` or `PkeyCtxRef::derive` using an output slice shorter than the full size required by the selected derivation algorithm. The attacker then triggers the application path that performs cryptographic derivation, for example by initiating or manipulating a protocol exchange that uses X25519, X448, DH, or HKDF-extract. OpenSSL 1.1.x writes the full derived output into the caller’s shorter buffer, corrupting adjacent stack or heap memory. The most likely observable result is process instability or a crash; in favorable memory layouts, the corruption could affect control data or application state and may create a path toward code execution.

How to fix it

Upgrade the Rust `openssl` crate to version 0.10.78 or later. Rebuild and redeploy all affected binaries so the fixed crate version is actually linked into production artifacts. Where feasible, also migrate runtime dependencies from OpenSSL 1.1.x to OpenSSL 3.x or later, because OpenSSL 3.x providers check the output length correctly for these operations. If immediate upgrade is not possible, audit all calls to `Deriver::derive` and `PkeyCtxRef::derive` and ensure output buffers are always at least as large as the maximum derived secret length for the selected algorithm: 32 bytes for X25519, 56 bytes for X448, the relevant prime-size output for DH, and the expected digest-length output for HKDF-extract. Treat this as a source-level and build-artifact issue: dependency manifests alone are insufficient unless all deployed binaries are rebuilt.

How to confirm the fix worked

Confirm dependency remediation by checking `Cargo.lock`, SBOMs, and build metadata for `openssl` crate version 0.10.78 or later. Confirm runtime mitigation by verifying linked OpenSSL versions with binary inspection or runtime diagnostics; OpenSSL 3.x is not affected by the vulnerable provider behavior described here. Search source code for `Deriver::derive`, `PkeyCtxRef::derive`, and direct uses of `EVP_PKEY_derive`, then verify that output buffers are sized correctly. Run unit, integration, or fuzz tests that exercise X25519, X448, DH, and HKDF-extract derivation paths with boundary-sized buffers. For native binaries, consider AddressSanitizer, Valgrind, or similar memory-safety testing to confirm no out-of-bounds write occurs during derivation.

Typical attack path

1. Identify a remotely reachable application or service built with rust-openssl versions 0.9.27 through 0.10.77.
2. Confirm or infer that the application is linked against OpenSSL 1.1.x rather than OpenSSL 3.x.
3. Find an exposed workflow that invokes `Deriver::derive` or `PkeyCtxRef::derive` for X25519, X448, DH, or HKDF-extract.
4. Send crafted or repeated protocol inputs that cause the vulnerable derivation routine to run with an undersized output buffer.
5. Trigger an out-of-bounds write when OpenSSL writes the full derived secret into the short slice.
6. Cause a crash, denial of service, or potentially manipulate memory depending on allocator behavior, stack layout, and surrounding application code.

How to detect it

There is no reliable network-only signature for exploitation because the overflow occurs inside application-specific cryptographic derivation code and the triggering protocol data will vary by product. To assess possible prior exploitation, correlate dependency exposure with application crash and memory-corruption telemetry. Review system logs, supervisor logs, container logs, core dumps, EDR events, and application logs for segmentation faults, aborts, allocator corruption, stack-smashing detections, or repeated restarts around cryptographic handshake or key-derivation activity. On Linux, check journald, syslog, kernel logs, coredumpctl, container orchestrator restart events, and crash-reporting systems for faults involving Rust binaries, `libcrypto.so.1.1`, or OpenSSL `EVP_PKEY_derive` call stacks. If core dumps are available, inspect stack traces for `openssl::derive::Deriver::derive`, `PkeyCtxRef::derive`, `EVP_PKEY_derive`, X25519, X448, DH, or HKDF functions. Because no public exploit or named threat actor activity is currently known, treat crash clusters against exposed cryptographic endpoints as suspicious but not conclusive without memory-forensic evidence.

• openssl::derive::Deriver::derive
• PkeyCtxRef::derive
• EVP_PKEY_derive
• libcrypto.so.1.1
• Segmentation fault
• stack smashing detected
• heap-buffer-overflow
• stack-buffer-overflow
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: stack-buffer-overflow
• malloc(): corrupted top size
• malloc(): invalid size
• free(): invalid pointer
• double free or corruption
• corrupted double-linked list
• coredumpctl
• signal 11
• SIGSEGV

What your security team should do

• Inventory Rust applications and services that use the `openssl` crate, prioritizing internet-facing services and cryptographic protocol handlers.
• Upgrade the `openssl` crate to 0.10.78 or later and rebuild all affected binaries.
• Identify deployments linked against OpenSSL 1.1.x and prioritize them over deployments using OpenSSL 3.x.
• Search code for `Deriver::derive`, `PkeyCtxRef::derive`, and `EVP_PKEY_derive` usage and verify output buffer sizing.
• Review crash telemetry for recent segmentation faults, allocator corruption, or abnormal restarts in services that perform key exchange or key derivation.
• Add regression tests for X25519, X448, DH, and HKDF-extract derivation paths to prevent future undersized-buffer usage.
• Because EPSS is currently low and there is no known KEV or ransomware use, prioritize based on exposure and use of affected APIs rather than CVSS alone.