CVE-2026-7383
Detail
Description
Issue summary: A signed integer overflow when sizing the destination
buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
buffer overflow.
Impact summary: A heap buffer overflow may lead to a crash or possibly
attacker controlled code execution or other undefined behaviour.
In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination
size for Unicode output is computed in a signed int: by left shift
of the input character count for BMPSTRING (UTF-16) and
UNIVERSALSTRING (UTF-32), and by summing per-character byte counts
for UTF8STRING. The calculation overflows when the input reaches
around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30
characters) the size wraps to zero, OPENSSL_malloc(1) is called, and
the subsequent character copy writes several gigabytes past the
one-byte allocation.
X.509 certificate processing routes through ASN1_STRING_set_by_NID(),
whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID
size limits cap the input length; no network protocol or
certificate-handling path in OpenSSL exercises the overflow.
Triggering the bug requires an application that calls
ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers
a custom string type via ASN1_STRING_TABLE_add(), with
attacker-controlled input on the order of half a gigabyte or more.
For these reasons this issue was assigned Low severity.
The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as the affected code is outside the OpenSSL FIPS module
boundary.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Weakness Enumeration
| CWE-ID |
CWE Name |
Source |
|
CWE-787
|
Out-of-bounds Write |
OpenSSL Software Foundation
|
Change History
6 change records found show changes
CVE Modified by CISA-ADP
6/17/2026 7:02:19 AM
| Action |
Type |
Old Value |
New Value |
| Added |
SSVC |
{"timestamp":"2026-06-09T00:00:00+00:00","id":"CVE-2026-7383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}
|
CVE Modified by OpenSSL Software Foundation
6/17/2026 7:02:19 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.1","versionType":"semver","status":"affected"},{"version":"3.6.0","lessThan":"3.6.3","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.7","versionType":"semver","status":"affected"},{"version":"3.4.0","lessThan":"3.4.6","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.21","versionType":"semver","status":"affected"},{"version":"1.1.1","lessThan":"1.1.1zh","versionType":"custom","status":"affected"},{"version":"1.0.2","lessThan":"1.0.2zq","versionType":"custom","status":"affected"}]}]
|
Initial Analysis by NIST
6/15/2026 10:46:08 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CPE Configuration |
OR
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zq
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1zh
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
*cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255 Types: Patch
|
| Added |
Reference Type |
OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory
|
CVE Modified by OpenSSL Software Foundation
6/10/2026 4:16:25 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083
|
| Added |
Reference |
https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
|
| Removed |
Reference |
https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
|
| Removed |
Reference |
https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74
|
| Removed |
Reference |
https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974
|
| Removed |
Reference |
https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083
|
| Removed |
Reference |
https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
|
CVE Modified by CISA-ADP
6/09/2026 1:17:50 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
New CVE Received from OpenSSL Software Foundation
6/09/2026 1:17:50 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Description |
Issue summary: A signed integer overflow when sizing the destination
buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
buffer overflow.
Impact summary: A heap buffer overflow may lead to a crash or possibly
attacker controlled code execution or other undefined behaviour.
In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination
size for Unicode output is computed in a signed int: by left shift
of the input character count for BMPSTRING (UTF-16) and
UNIVERSALSTRING (UTF-32), and by summing per-character byte counts
for UTF8STRING. The calculation overflows when the input reaches
around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30
characters) the size wraps to zero, OPENSSL_malloc(1) is called, and
the subsequent character copy writes several gigabytes past the
one-byte allocation.
X.509 certificate processing routes through ASN1_STRING_set_by_NID(),
whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID
size limits cap the input length; no network protocol or
certificate-handling path in OpenSSL exercises the overflow.
Triggering the bug requires an application that calls
ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers
a custom string type via ASN1_STRING_TABLE_add(), with
attacker-controlled input on the order of half a gigabyte or more.
For these reasons this issue was assigned Low severity.
The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by
this issue, as the affected code is outside the OpenSSL FIPS module
boundary.
|
| Added |
CWE |
CWE-787
|
| Added |
Reference |
https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
|
| Added |
Reference |
https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74
|
| Added |
Reference |
https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974
|
| Added |
Reference |
https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083
|
| Added |
Reference |
https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
|
| Added |
Reference |
https://openssl-library.org/news/secadv/20260609.txt
|
Quick Info
CVE Dictionary Entry: CVE-2026-7383 NVD
Published Date: 06/09/2026 NVD
Last Modified: 06/17/2026
Source: OpenSSL Software Foundation
|
