CVE-2026-9076: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-9076 is a heap out-of-bounds read vulnerability in OpenSSL's CMS password-based decryption (RFC 3211 / PWRI key unwrap) implementation, specifically in the kek_unwrap_key() function in crypto/cms/cms_pwri.c. An unauthenticated attacker can supply crafted CMS data specifying a stream-mode KEK cipher to bypass the block-length guard and trigger a heap buffer over-read, potentially causing a Denial of Service. Affected versions include OpenSSL 1.0.2 before 1.0.2zq, 1.1.1 before 1.1.1zh, 3.0.x before 3.0.21, 3.4.x before 3.4.6, 3.5.x before 3.5.7, 3.6.x before 3.6.3, and 4.0.0. The vulnerability was disclosed on June 9, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (OpenSSL Advisory, Github Advisory).

The root cause is an out-of-bounds read (CWE-125) in kek_unwrap_key() within crypto/cms/cms_pwri.c. The RFC 3211 check-byte test unconditionally reads 7 bytes (tmp[1] through tmp[6]) from a heap-allocated buffer sized based on the wrapped key length. The existing minimum-length guard (inlen >= 2 * blocklen) is only effective when blocklen >= 4; however, the KEK cipher is selected from an OID in the attacker-controlled PWRI keyEncryptionAlgorithm field with no enforcement that it must be a block cipher. When an attacker specifies a stream-mode cipher (block size of 1), the guard becomes ineffective, the allocated buffer can be smaller than 7 bytes, and the check-byte read overruns the allocation. The fix rejects any cipher with blocklen < 4 in the early sanity check, ensuring all valid CMS KEK ciphers (DES/3DES = 8, AES = 16) satisfy the constraint. No password knowledge is required to trigger the over-read, as it occurs during the unwrap attempt before any authentication (OpenSSL Advisory, OpenSSL Commit).

The primary impact is Denial of Service: if the heap allocation for the unwrapped key ends at a memory page boundary and the following page is unmapped, the out-of-bounds read triggers a crash of the affected application. There is no confidentiality impact, as the over-read bytes are not returned to the attacker or written to any output. Integrity is also unaffected. Only applications that call CMS_decrypt() or CMS_decrypt_set1_password() (or equivalently use openssl cms -decrypt -pwri_password) on untrusted CMS data are vulnerable; FIPS modules are not affected (OpenSSL Advisory, Github Advisory).

1. Craft malicious CMS data: Construct a CMS PasswordRecipientInfo (PWRI) structure specifying a stream-mode cipher OID (e.g., RC4) in the keyEncryptionAlgorithm field instead of a valid block cipher.
2. Set a minimal wrapped key: Include a short wrapped key payload in the CMS structure — the length only needs to satisfy inlen >= 2 * blocklen for the stream cipher's block size of 1, so even a 2-byte wrapped key passes the guard.
3. Deliver the CMS data: Submit the crafted CMS message to any application that calls CMS_decrypt() or CMS_decrypt_set1_password() on attacker-supplied input (e.g., via a file upload, API endpoint, or email processing pipeline).
4. Trigger the over-read: OpenSSL's kek_unwrap_key() proceeds to the check-byte test and reads 7 bytes from the undersized heap buffer; if the allocation borders an unmapped page, the process crashes with a segmentation fault, achieving Denial of Service (OpenSSL Advisory, OpenSSL Commit).

• Logs: Application crash logs or core dumps referencing kek_unwrap_key or cms_pwri.c in the stack trace; segmentation fault signals from OpenSSL-linked processes.
• Network: Unexpected or malformed CMS-encrypted messages submitted to services that perform password-based CMS decryption; repeated delivery of CMS data with unusual keyEncryptionAlgorithm OIDs (e.g., RC4/stream cipher OIDs instead of AES or 3DES).
• Process: Abnormal termination (SIGSEGV) of processes using CMS_decrypt() or CMS_decrypt_set1_password(), particularly when processing externally supplied CMS data.

Update OpenSSL to a patched version: 1.0.2zq or later, 1.1.1zh or later, 3.0.21 or later, 3.4.6 or later, 3.5.7 or later, 3.6.3 or later, or 4.0.0 (fixed). Downstream distributions including Ubuntu (USN-8414-1/2), Red Hat (RHSA-2026:25237, RHSA-2026:25239, RHSA-2026:26319), SUSE (SUSE-SU-2026:2392-1, SUSE-SU-2026:2399-1, SUSE-SU-2026:2403-1), Debian (DLA-4630-1), FreeBSD, Alpine, and openSUSE have all issued updates. As a workaround where immediate patching is not possible, restrict processing of CMS data to trusted sources only and avoid exposing CMS_decrypt() or CMS_decrypt_set1_password() to untrusted input (OpenSSL Advisory, Github Advisory).

The OpenSSL project published a formal security advisory on June 9, 2026, and the fix was authored by Nikola Pajkovsky and reviewed by Tomas Mraz and other OpenSSL maintainers. The vulnerability was discussed on the oss-security mailing list shortly after disclosure. Major Linux distributions responded quickly with coordinated patch releases within days of the advisory. Microsoft also acknowledged the CVE via the MSRC update guide. Community reaction has been measured given the limited practical exploitability (crash requires specific memory layout conditions) and the absence of information disclosure (OpenSSL Advisory, oss-security).