CVE-2026-42771

What it actually does

CVE-2026-42771 is an out-of-bounds read in OpenSSL email-address validation used by X509_VERIFY_PARAM_set1_email() and X509_VERIFY_PARAM_add1_email(). When an application validates a crafted email address, such as during S/MIME certificate or message validation, an internal helper can use an incorrect length while checking the local part of the address. This may fail to enforce the 64-octet local-part limit or read beyond the intended buffer. The expected impact is process crash and denial of service; the issue is not expected to directly disclose the out-of-bounds data to the attacker. OpenSSL FIPS modules are not affected because the vulnerable code is outside the FIPS module boundary.

Why it matters to the business

Organizations using OpenSSL-backed applications for S/MIME, mail security, certificate validation, or other workflows that validate email addresses can experience application crashes or service disruption when processing maliciously crafted messages. The most likely business consequence is degraded or unavailable email processing, signature validation, secure mail handling, or dependent automation. Public exploitation is not currently known, the issue is not in CISA KEV, it is not associated with ransomware campaigns, and EPSS is low and flat at approximately 0.0022 over 30 days, so urgency is moderate rather than emergency-driven; however, internet-facing or automated mail-processing systems should still be prioritized because exploitation may require only delivery of a crafted message to a vulnerable processing path.

How an attack unfolds

An attacker identifies an application that uses OpenSSL to validate email addresses in certificates or S/MIME messages. The attacker crafts an email message with a malformed or overlong From address, particularly targeting the local part of the address, and sends it to a system that automatically performs S/MIME or certificate identity validation. When the vulnerable application calls X509_VERIFY_PARAM_set1_email() or X509_VERIFY_PARAM_add1_email(), OpenSSL uses an incorrect length during validation and may read beyond the intended memory buffer. In typical exploitation, this causes the application process to terminate with a segmentation fault or similar crash. Repeated delivery or processing of the crafted message can cause recurring denial of service until the message is removed, filtering is applied, or the vulnerable OpenSSL code is updated.

How to fix it

Upgrade OpenSSL packages to vendor-provided fixed releases as soon as they are available for the affected distribution, appliance, application, container image, or embedded product. Because no exact fixed version was provided in the input, use the operating system, application, or OpenSSL project advisory for authoritative fixed builds. Rebuild and redeploy software that statically links OpenSSL, since operating-system package upgrades alone will not update statically bundled copies. Restart all affected services after patching so they load the corrected library. As temporary mitigations, filter or quarantine S/MIME messages and messages with malformed or overlong email local parts before they reach vulnerable validators, enforce the 64-octet email local-part limit in application code before calling OpenSSL validation APIs, disable automatic processing of untrusted S/MIME messages where operationally acceptable, and run mail-processing services under supervisors that limit crash-loop impact.

How to confirm the fix worked

Confirm exposure by inventorying all OpenSSL versions used by mail gateways, S/MIME processors, certificate-validation services, desktop mail clients, content scanners, containers, and statically linked applications. Check both dynamic dependencies and bundled OpenSSL copies. Validate remediation by confirming the installed OpenSSL build matches the vendor fixed release and that affected services have been restarted or redeployed. In a controlled non-production environment, process a test S/MIME or email-validation case with an overlong or malformed local part and verify the application rejects it cleanly without crashing. Review crash telemetry before and after patching for disappearance of segmentation faults or aborts in OpenSSL email-validation paths.

Typical attack path

1. Identify software that performs S/MIME validation or OpenSSL-backed certificate email-address validation.
2. Craft an email message containing a malformed From address or an email local part designed to trigger incorrect length handling.
3. Deliver the crafted message to a mailbox, mail gateway, content scanner, client, or automation workflow that validates S/MIME or email identities.
4. Wait for the target application to parse the message and call the affected OpenSSL email validation functions.
5. Trigger an out-of-bounds read that causes the validating process to crash.
6. Repeat delivery or cause reprocessing of the same message to sustain denial of service.

How to detect it

Look for evidence of crashes in applications that process email, S/MIME, or certificate email identity validation. Relevant sources include mail gateway logs, S/MIME validation logs, application stderr/stdout, system journals, Windows Event Logs, EDR crash telemetry, core dump directories, container restart events, and service supervisor logs. Search for segmentation faults, access violations, aborts, or repeated restarts involving OpenSSL-linked mail-processing processes shortly after receiving or validating messages with unusual From headers. Preserve and inspect messages that correlate with crashes, especially those with malformed addresses, quoted or encoded local parts, or local parts exceeding 64 octets. If debug symbols, stack traces, or crash dumps are available, look for OpenSSL email-validation functions such as X509_VERIFY_PARAM_set1_email() or X509_VERIFY_PARAM_add1_email(). Absence of these artifacts does not prove non-exploitation, because the flaw generally causes availability impact rather than leaving a unique network signature.

• X509_VERIFY_PARAM_set1_email
• X509_VERIFY_PARAM_add1_email
• segmentation fault
• SIGSEGV
• access violation
• core dumped
• S/MIME validation failed
• From:

What your security team should do

• Prioritize patching systems that automatically process inbound email, S/MIME messages, signed email, or certificate identities using OpenSSL.
• Inventory applications and appliances that bundle or statically link OpenSSL; do not rely only on operating-system package scans.
• Apply vendor fixed OpenSSL updates when available, rebuild dependent software, and restart or redeploy affected services.
• Temporarily filter, quarantine, or reject messages with malformed addresses or local parts longer than 64 octets where this does not disrupt business requirements.
• Monitor mail-processing and S/MIME-validation services for crashes, core dumps, and repeated processing failures tied to specific messages.
• Remove or quarantine suspicious messages that repeatedly crash validators to prevent denial-of-service loops.
• Treat current threat likelihood as lower because EPSS is low, no exploitation maturity is reported, and the issue is not KEV-listed, but maintain normal vulnerability management timelines for availability-impacting flaws.