CVE-2026-63072: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-63072 is a heap out-of-bounds write vulnerability in OpenSSL's CMS (Cryptographic Message Syntax) decryption code, specifically in the AES-WRAP-PAD key unwrapping primitive. When decrypting a CMS message, OpenSSL sizes the key-unwrap output buffer based on the reported unwrapped key size, but the AES-WRAP-PAD primitive can write and cleanse up to 8 bytes beyond that allocation on its integrity-failure paths. Affected versions include OpenSSL 1.1.1 before 1.1.1zi, 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2. Disclosed on August 25, 2026, it carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenSSL SecAdv).

The root cause is CWE-787 (Out-of-bounds Write): the cms_kek_cipher() function in crypto/cms/cms_kari.c and crypto/cms/cms_kemri.c allocates the output buffer using the size returned by EVP_CipherUpdate() with a NULL output pointer (which reports the expected unwrapped key size), but the AES-WRAP-PAD primitive's integrity-failure cleanup path writes and cleanses up to inlen bytes — which can be 8 bytes larger than the reported output size. An attacker can take a legitimate CMS message and flip a single OID byte to select the padded variant (id-aesNNN-wrap-pad instead of id-aesNNN-wrap), triggering the overflow during the recipient's decryption attempt via CMS_decrypt(). The write is fixed-size (8 bytes), fixed-value (zero), and deterministic, requiring no special configuration or authentication (GitHub Commit, GitHub Advisory).

Successful exploitation causes deterministic heap corruption immediately past the allocated buffer, typically resulting in a Denial of Service (crash) of the application calling CMS_decrypt(). Because the write is fixed-size and fixed-value (zeroing 8 bytes past the allocation), reliable code execution is considered unlikely, but heap metadata corruption can cause unpredictable application behavior. Any service that decrypts attacker-supplied CMS messages — including S/MIME email gateways, PKI systems, and applications using ECDH key agreement or ML-KEM decapsulation — is at risk of service disruption (GitHub Advisory, OpenSSL SecAdv).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code is publicly available. A GitHub repository (0xBlackash/CVE-2026-63072) exists but contains only a version-detection script and mitigation guidance, not exploit code (GitHub Advisory). The EPSS score is approximately 0.61%, reflecting low near-term exploitation probability. The vulnerability is marked as automatable (no user interaction required) and is network-accessible without privileges, but NVD SSVC assessment indicates no known exploitation at this time. It is not currently listed in the CISA KEV catalog.

1. Identify target: Locate a service or application that accepts and decrypts CMS-formatted messages from external sources (e.g., S/MIME email processing, CMS-based key exchange endpoints) running a vulnerable OpenSSL version.
2. Obtain a legitimate CMS message: Acquire or generate a valid CMS EnvelopedData message encrypted for the target recipient using ECDH key agreement or ML-KEM decapsulation with an AES key-wrap cipher.
3. Modify the key-wrap OID: In the CMS structure, locate the key-wrap algorithm OID and change it from the non-padded variant (e.g., id-aes256-wrap) to the padded variant (id-aes256-wrap-pad) by flipping a single byte in the DER-encoded message.
4. Deliver the crafted message: Send the modified CMS message to the target application so it is processed by CMS_decrypt().
5. Trigger heap overflow: The recipient's OpenSSL library allocates a buffer sized for the non-padded output, but the AES-WRAP-PAD primitive writes and cleanses up to 8 bytes past the allocation on its integrity-failure path, corrupting the heap and causing a crash (DoS) (GitHub Advisory, GitHub Commit).

• Logs: Application crash logs or core dumps from processes invoking CMS_decrypt(); OpenSSL error logs referencing CMS integrity failure or heap allocation errors immediately before a crash.
• Process: Unexpected termination (SIGABRT, SIGSEGV) of services processing S/MIME or CMS messages; repeated restarts of mail gateway or PKI service processes.
• Network: Inbound CMS/S/MIME messages with a key-wrap OID set to a padded AES-WRAP-PAD variant (id-aes128-wrap-pad, id-aes192-wrap-pad, id-aes256-wrap-pad) where the non-padded variant would be expected; anomalous or malformed DER-encoded CMS structures in network traffic.

Update OpenSSL to a patched release: 1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2. Downstream distributions including Ubuntu (USN-8678-1/2/3), SUSE (SUSE-SU-2026:3878-1, SUSE-SU-2026:4033-1, SUSE-SU-2026:4037-1), openSUSE, FreeBSD (FreeBSD-SA-26:61.openssl), Alpine, Debian, and Slackware have released updated packages. As a workaround where patching is not immediately possible, restrict CMS decryption operations to messages from trusted sources only, and monitor for unexpected application crashes in OpenSSL-dependent services (OpenSSL SecAdv, Ubuntu Advisory, FreeBSD Advisory).

The vulnerability was covered by multiple security news outlets including CyberSecurityNews, GBHackers, and SecurityOnline, which reported it as part of a broader OpenSSL August 2026 security update addressing nine vulnerabilities. Trail of Bits noted the release on Mastodon (Trail of Bits). Community sentiment characterized the flaw as serious but limited in practical impact due to the fixed-size, fixed-value nature of the overflow and the DoS-only consequence. The Hawk-Eye threat landscape digest included it in the Week 35 threat roundup (Hawk-Eye Digest).