Originally published at HOL

CVE-2026-63072: OpenSSL CMS decrypt writes eight bytes past the unwrap buffer

OpenSSL published nine CVEs on 25 August 2026. None of them is High. None of them is in the FIPS module. Most of them only exist if your process speaks QUIC, CMP, DTLS, or RFC 7250 raw public keys. The one that still hits a boring OpenSSL 3.0 LTS install is this CMS unwrap overflow. If swapping the CVE ID would still leave this page useful, we would not have shipped it. The operator question is which of the nine you actually run.

Who is not in scope

OpenSSL's 25 August 2026 advisory is explicit. The FIPS module is not affected by any of these nine. OpenSSL 3.1, 3.2, and 3.3 are out of support and were not analysed. OpenSSL 1.0.2 is not affected by the CMS overflow. A TLS-only server that never decrypts a CMS/PKCS#7 message, never stands up QUIC, never runs a CMP client or server, and never buffers DTLS handshakes is not on the Moderate CMS path and not on the QUIC or CMP paths. Distro packages that ship no-cms, no-quic, or no-cmp drop those features at compile time. This is not a TLS handshake bug. It is not Heartbleed. It is not unauthenticated remote code execution.

OpenSSL 3.0 LTS is also not in the QUIC double-free, the QUIC ACK-memory issue, the CMP format-string, or the raw-public-key NULL deref. Those start at 3.4 or 3.5. If you are on 3.0 and you do not decrypt CMS, the remaining Low issue that can still touch a generic 3.0 build is empty-ciphertext AEAD via EVP_Cipher() (CVE-2026-75803), and only if the app uses that one-shot API on ChaCha20-Poly1305 or AES-OCB with an empty body.

The 3.0 issue: CMS unwrap overflow

CVE-2026-63072 is Moderate in OpenSSL's own policy. No CVSS is published in the advisory. HOL's evidence pack has no score to cite. Not in CISA KEV. NVD had not published an analysis score at research time.

CMS key-agreement and KEM recipient-info decryption size the unwrap output buffer from what EVP_CipherUpdate(..., NULL, ...) reports. AES-WRAP-PAD (RFC 5649) can still write and cleanse up to the input length on its integrity-failure path, which is eight bytes more than that query. The attacker does not need a valid wrapped key. They take a legitimate CMS message and flip one OID byte so the unwrap primitive is the padded variant. The RFC 5649 integrity check then fails, and CMS_decrypt() still performs a deterministic eight-byte zero write immediately past the heap allocation. Typical result is a crash. OpenSSL does not claim remote code execution for this write.

The fix is in crypto/cms/cms_kari.c and crypto/cms/cms_kemri.c (example commit 2a3dac874c8057c1f0186849bf1ede1ae7b6b756 on the 4.0 line). Both now allocate max(queried_outlen, inlen) so a failed unwrap cannot write past the buffer. Bhabani Sankar Das reported it on 18 June 2026. Filipe Casal at Trail of Bits reported it independently on 29 June 2026. Daniel Kubec wrote the fix.

Affected trains from the advisory: OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, and 1.1.1. OpenSSL 1.0.2 is not affected. Fixed in 4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22. OpenSSL 1.1.1zi is premium-support only.

How to check

Print the library you are actually linked against, not the package name you remember:

openssl version
openssl version -a

Compare the first line to 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2. Anything older on those trains is still the 25 August set. Then see which of the advisory's features exist in this binary:

openssl cms -help
openssl cmp -help
openssl list -public-key-algorithms 2>/dev/null | head
openssl version -a | tr ' ' '\n' | grep -E 'quic|cms|cmp|dgram|dtls' || true

If openssl cms is an unknown command, this specific CVE is not reachable in that build. If the version string is 3.0.x and there is no QUIC, CVE-2026-18798 and CVE-2026-63075 do not apply. If openssl cmp is missing, the three CMP CVEs do not apply. Apps that never call CMS_decrypt() are out even when the CLI ships CMS. That is the check the advisory does not write down as a command.

How to fix

Upgrade OpenSSL to the patched release on your train:

# OpenSSL 3.0 LTS
# 3.0.22
# OpenSSL 3.4
# 3.4.7
# OpenSSL 3.5
# 3.5.8
# OpenSSL 3.6
# 3.6.4
# OpenSSL 4.0
# 4.0.2

Tarballs are on the OpenSSL source page as of 25 August 2026: openssl-3.0.22.tar.gz, openssl-3.4.7.tar.gz, openssl-3.5.8.tar.gz, openssl-3.6.4.tar.gz, openssl-4.0.2.tar.gz. Rebuild anything statically linked. Distro packages will lag the CNA date. Do not assume your current libssl already carries these CVE IDs. There is no workaround in the advisory for the CMS overflow other than not decrypting untrusted CMS, which is not a real control if the product's job is to decrypt CMS.

The other eight, same advisory

Treat them as one upgrade. Do not file eight tickets. OpenSSL rated three Moderate and six Low. Quote those ratings. Do not invent CVSS.

CVE-2026-18798 (Moderate). QUIC server double-frees the QRX object when port_bind_channel() fails on a malformed INITIAL with a destination connection ID shorter than 8 bytes. Process abort, DoS. OpenSSL says remote code execution from this double-free is highly improbable. OpenSSL 4.0, 3.6, 3.5 only. Not 3.4, not 3.0.
CVE-2026-63076 (Moderate). CMP server (or client talking to a hostile CMP endpoint) treats a crafted protectionAlg parameter as PBMParameter without checking ASN.1 type. Unauthenticated crash. CMP is opt-in. OpenSSL 4.0 through 3.0. Not 1.1.1.
CVE-2026-14457 (Low). RFC 7250 raw public keys, private key configured with no certificate, peer sends signature_algorithms_cert. NULL deref. OpenSSL 4.0 through 3.4. Not 3.0.
CVE-2026-54874 (Low). DTLS buffers a future-epoch record using far more memory than the record needs. AWS reported it. OpenSSL 4.0 through 1.0.2.
CVE-2026-63073 (Low). CMP client passes an attacker-controlled sender DN to ERR_raise_data() as a format string. Crash. OpenSSL 4.0 through 3.4. Not 3.0.
CVE-2026-63074 (Low). CMP server reusing one OSSL_CMP_CTX never drops rejected extraCerts. Memory growth. OpenSSL 4.0 through 3.0.
CVE-2026-63075 (Low). QUIC retains ACK-only packet metadata for the connection lifetime if the peer withholds acks. OpenSSL 4.0 through 3.4. Not 3.0.
CVE-2026-75803 (Low). EVP_Cipher() on empty ciphertext skips the AEAD tag check for ChaCha20-Poly1305 and AES-OCB. Forged empty messages can look valid. OpenSSL 4.0 through 3.0. Those algorithms are not in the FIPS module.

This article is the operator write-up: which of the nine you run, and which train to take. The HOL Guard evidence page is the source record for CVE-2026-63072.