CVE-2026-41681

Katalog CVE

CVSS 7.5 · High EPSS 0,36%

Kerentanan Stack-based Buffer Overflow pada rust-openssl project rust-openssl. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qj advisory vendor
• https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe patch
• https://github.com/rust-openssl/rust-openssl/pull/2608 issue tracking
• https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78 release notes