CVE-2026-7383
Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
Description
Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
INFO
Published Date :
June 9, 2026, 5:17 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update OpenSSL to a patched version.
- Apply vendor security patches.
- Avoid direct calls to ASN1_mbstring_copy().
- Limit input size for string conversions.
Public PoC/Exploit Available at Github
CVE-2026-7383 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-7383.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-7383 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-7383
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Tooling for generating and manipulating Software Bill of Materials (SBOMs) for OpenVox projects.
Ruby
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-7383 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-7383 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: OpenSSL, Description: Resumen del problema: Un desbordamiento de entero con signo al dimensionar el búfer de destino para la salida Unicode en ASN1_mbstring_ncopy() puede conducir a un desbordamiento de búfer de pila. Resumen del impacto: Un desbordamiento de búfer de pila puede conducir a un fallo o posiblemente a la ejecución de código controlado por el atacante u otro comportamiento indefinido. En ASN1_mbstring_copy() y ASN1_mbstring_ncopy() el tamaño de destino para la salida Unicode se calcula en un entero con signo: mediante un desplazamiento a la izquierda del recuento de caracteres de entrada para BMPSTRING (UTF-16) y UNIVERSALSTRING (UTF-32), y sumando los recuentos de bytes por carácter para UTF8STRING. El cálculo desborda cuando la entrada alcanza alrededor de 2^30 caracteres. En el peor de los casos (UNIVERSALSTRING con 2^30 caracteres) el tamaño se ajusta a cero, se llama a OPENSSL_malloc(1), y la copia de caracteres subsiguiente escribe varios gigabytes más allá de la asignación de un byte. El procesamiento de certificados X.509 se encamina a través de ASN1_STRING_set_by_NID(), cuya máscara DIRSTRING_TYPE excluye UNIVERSALSTRING y cuyos límites de tamaño por NID restringen la longitud de entrada; ningún protocolo de red o ruta de manejo de certificados en OpenSSL ejerce el desbordamiento. Activar el error requiere una aplicación que llama a ASN1_mbstring_copy() o ASN1_mbstring_ncopy() directamente, o registra un tipo de cadena personalizado a través de ASN1_STRING_TABLE_add(), con entrada controlada por el atacante del orden de medio gigabyte o más. Por estas razones, a este problema se le asignó una severidad Baja. Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el código afectado está fuera del límite del módulo FIPS de OpenSSL. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'OpenSSL', 'product': 'OpenSSL', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.0.1', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.6.0', 'lessThan': '3.6.3', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.5.0', 'lessThan': '3.5.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.4.0', 'lessThan': '3.4.6', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.0.0', 'lessThan': '3.0.21', 'versionType': 'semver'}, {'status': 'affected', 'version': '1.1.1', 'lessThan': '1.1.1zh', 'versionType': 'custom'}, {'status': 'affected', 'version': '1.0.2', 'lessThan': '1.0.2zq', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-7383', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-09T00:00:00+00:00'} -
Initial Analysis by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zq *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1zh *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3 *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:* Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255 Types: Patch Added Reference Type OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory -
CVE Modified by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added Reference https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6 Added Reference https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74 Added Reference https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974 Added Reference https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083 Added Reference https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255 Removed Reference https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6 Removed Reference https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74 Removed Reference https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974 Removed Reference https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083 Removed Reference https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 09, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Jun. 09, 2026
Action Type Old Value New Value Added Description Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Added CWE CWE-787 Added Reference https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6 Added Reference https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74 Added Reference https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974 Added Reference https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083 Added Reference https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255 Added Reference https://openssl-library.org/news/secadv/20260609.txt