CVE-2026-9076

What it actually does

This vulnerability affects OpenSSL applications that process untrusted CMS password-recipient information using CMS_decrypt(), CMS_decrypt_set1_password(), or the equivalent openssl cms -decrypt -pwri_password workflow. An attacker can craft CMS data where the PWRI keyEncryptionAlgorithm selects a stream-mode key-encryption-key cipher instead of a block cipher. Because kek_unwrap_key() performs RFC 3211 check-byte validation using assumptions that only hold for block ciphers, the unwrapped key buffer can be smaller than expected and OpenSSL may read several bytes past the end of a heap allocation. The over-read is not returned to the attacker, so confidentiality impact is not expected; the practical impact is application crash and denial of service when memory layout conditions cause the read to cross into unmapped memory. OpenSSL FIPS modules are reported as not affected.

Why it matters to the business

Services that accept or decrypt externally supplied CMS messages may be remotely crashed by unauthenticated attackers, causing outages, failed message-processing workflows, or degraded availability for systems that rely on OpenSSL CMS password-based decryption. The issue has a high availability CVSS impact but low current exploitation likelihood based on the supplied EPSS score and no known KEV listing. Operational urgency is highest for internet-facing gateways, automated mail/document processing systems, file-ingestion pipelines, and APIs that process CMS/PKCS#7 content from untrusted sources.

How an attack unfolds

An attacker identifies an application or service that passes attacker-controlled CMS content into OpenSSL CMS password-based decryption. The attacker then crafts a CMS message using PWRI password-recipient metadata and sets the keyEncryptionAlgorithm OID to a stream-mode cipher. During decryption, OpenSSL attempts to unwrap the content-encryption key before successful password authentication is established, so the attacker does not need to know the password. The vulnerable unwrap path allocates a buffer based on the attacker-controlled wrapped key length, performs an insufficient length check based on the selected cipher, and then reads RFC 3211 check bytes beyond the end of the heap buffer. In most executions this may only cause an invalid read with no visible effect, but if the allocation sits at a page boundary and the following page is unmapped, the process can crash, producing a denial-of-service condition.

How to fix it

Upgrade OpenSSL to a vendor-provided version that contains the fix as soon as one is available for the affected release line; no exact fixed versions were supplied in the input. Prioritize packages that link against OpenSSL and process CMS/PKCS#7 data from external or untrusted sources. Where immediate upgrade is not possible, reduce exposure by disabling CMS password-recipient decryption for untrusted input, rejecting CMS PWRI structures that specify non-block-cipher keyEncryptionAlgorithm OIDs, placing CMS parsing/decryption in a sandboxed worker process with restart limits, and applying request size/rate limits to CMS ingestion endpoints. The FIPS modules are reported as unaffected, but applications using non-FIPS OpenSSL CMS decryption APIs should still be reviewed.

How to confirm the fix worked

Confirm the deployed OpenSSL library and all statically linked applications are updated to a fixed vendor build once available. Inventory applications for direct or indirect use of CMS_decrypt(), CMS_decrypt_set1_password(), or command-line openssl cms -decrypt -pwri_password handling. Validate that untrusted CMS inputs are either rejected, constrained to safe algorithms, or processed only by patched components. In test environments, use negative tests with malformed CMS PWRI messages using stream-mode cipher OIDs and confirm the application rejects the input without crashing. Also confirm crash monitoring, service supervision, and core-dump collection are enabled for CMS-processing components so attempted exploitation is observable.

Typical attack path

1. Find an application, API, gateway, or batch-processing service that accepts CMS/PKCS#7 content from untrusted users or networks.
2. Submit a crafted CMS object that uses password-recipient information with an attacker-chosen PWRI keyEncryptionAlgorithm.
3. Select a stream-mode KEK cipher OID so the vulnerable length guard does not provide the expected protection.
4. Choose a wrapped-key length that leaves the unwrapped key buffer too small for the RFC 3211 check-byte read.
5. Trigger CMS_decrypt() or CMS_decrypt_set1_password() in the target application.
6. Cause a heap out-of-bounds read in kek_unwrap_key(); under favorable memory layout conditions, crash the process and deny service.

How to detect it

Historical exploitation is most likely to appear as application instability rather than data theft. Review application logs, reverse-proxy logs, API gateway logs, mail/file-ingestion logs, crash reporters, system journals, and endpoint telemetry for malformed CMS or PKCS#7 submissions followed by segmentation faults, aborts, service restarts, or core dumps. On Linux, inspect journald, syslog, kernel logs, coredumpctl, supervisor logs, and container orchestrator restart events for crashes in processes that call OpenSSL CMS decryption. If core dumps are available, examine backtraces for OpenSSL functions such as kek_unwrap_key(), CMS_decrypt(), CMS_decrypt_set1_password(), or CMS_RecipientInfo_decrypt(). Correlate crash timestamps with inbound requests or files containing CMS ContentInfo, EnvelopedData, PasswordRecipientInfo, PWRI, or unusual keyEncryptionAlgorithm OIDs. Because the issue does not disclose memory and exploitability depends on heap layout, absence of successful crashes does not prove absence of probing; repeated CMS parse/decrypt failures from the same source should be treated as suspicious.

• kek_unwrap_key
• CMS_decrypt
• CMS_decrypt_set1_password
• CMS_RecipientInfo_decrypt
• openssl cms -decrypt -pwri_password
• PWRI
• PasswordRecipientInfo
• keyEncryptionAlgorithm
• id-alg-PWRI-KEK
• PKCS7_decrypt
• Segmentation fault
• SIGSEGV
• core dumped
• AddressSanitizer: heap-buffer-overflow
• AddressSanitizer: heap-buffer-overread
• heap-buffer-overflow in kek_unwrap_key
• heap-buffer-overread in kek_unwrap_key

What your security team should do

• Prioritize exposure review for internet-facing or partner-facing services that process CMS/PKCS#7 data using OpenSSL password-based decryption.
• Patch OpenSSL and dependent packages as soon as fixed versions are released by the operating system, container image, appliance, or application vendor.
• Until patched, block or reject untrusted CMS PWRI content that specifies stream-mode KEK ciphers or unexpected keyEncryptionAlgorithm OIDs.
• Search crash logs, core dumps, and application telemetry for crashes in or near kek_unwrap_key(), CMS_decrypt(), or CMS_decrypt_set1_password().
• Add monitoring for repeated failed CMS decryption attempts, malformed PKCS#7/CMS submissions, and process restarts in services that handle encrypted CMS content.
• Run dependency and container-image scans to identify OpenSSL instances, including statically linked binaries that may not be visible through OS package inventory.
• For high-availability services, isolate CMS parsing/decryption in restartable workers with rate limiting to reduce denial-of-service blast radius.