CVE-2026-28386: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-28386 is an out-of-bounds read vulnerability in OpenSSL's AES-CFB128 implementation on x86-64 systems with AVX-512 and VAES instruction support. It affects OpenSSL versions 3.6.0 through 3.6.1 (fixed in 3.6.2), specifically the OpenSSL FIPS module. The vulnerability was disclosed on April 7, 2026, with a patch committed on April 6, 2026. OpenSSL assessed it as Low severity internally, though the CVSS v3.1 base score is 7.5 (High) per NVD (OpenSSL Advisory, GitHub Advisory).

The root cause (CWE-125: Out-of-bounds Read) lies in the partial-block pre-processing code within ossl_aes_cfb128_vaes_enc and ossl_aes_cfb128_vaes_dec in crypto/aes/asm/aes-cfb-avx512.pl. These functions used unmasked vmovdqu8 instructions to unconditionally load 16 bytes from the input buffer even when fewer bytes were valid, potentially reading 1–15 bytes beyond the buffer end. The fix replaces the unmasked loads with masked loads (vmovdqu8 (%r11),%xmm0{%k1}{z} and vmovdqu8 ($inp),%xmm1{%k1}{z}), consistent with the correct approach already used in the post-processing code. Exploitation requires three simultaneous conditions: the system must be x86-64 with AVX-512/VAES support, the application must use AES-CFB128 mode with partial block processing across multiple calls, and the input buffer must end at a memory page boundary with the next page unmapped (OpenSSL Commit, OpenSSL Advisory).

The primary impact is a Denial of Service (DoS): if the over-read crosses an unmapped memory page boundary, the application crashes. There is no confidentiality impact, as the over-read bytes are not written to output or otherwise disclosed. The vulnerability does not affect TLS/DTLS protocols (which use CBC, GCM, CCM, or ChaCha20-Poly1305), significantly limiting real-world exposure to applications explicitly using AES-CFB128 mode on affected hardware (OpenSSL Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.019% (0.000190), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The narrow exploitation conditions — requiring specific hardware, cipher mode, and memory layout — further reduce practical exploitability (OpenSSL Advisory).

Upgrade OpenSSL to version 3.6.2 or later, which contains the fix for this vulnerability (OpenSSL Advisory, OpenSSL Commit). Organizations that cannot immediately upgrade should prioritize systems meeting all three conditions: x86-64 architecture with AVX-512/VAES support, use of AES-CFB128 encryption mode, and multi-call partial block processing patterns. Systems using only TLS/DTLS with standard cipher modes (CBC, GCM, CCM, ChaCha20-Poly1305) are not affected and can deprioritize patching accordingly.

The release of OpenSSL 3.6.2 received coverage from Linux-focused outlets including 9to5Linux, Linuxiac, and Help Net Security, which highlighted the security fixes bundled in the release (Help Net Security). Security news sites such as CyberSecurityNews and IT Security News also covered the broader set of CVEs fixed in OpenSSL 3.6.2. Community reaction was generally measured, reflecting the narrow exploitation conditions and OpenSSL's own Low severity assessment, with no significant alarm or controversy noted.