Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-41676 is a high-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Rust-Openssl Project Rust-Openssl. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41676 is a buffer overflow vulnerability in the rust-openssl crate, which provides OpenSSL bindings for the Rust programming language. It affects versions from 0.9.27 up to but not including 0.10.78, specifically in the Deriver::derive and PkeyCtxRef::derive functions. These functions set the length parameter to the provided buffer's length and pass it to OpenSSL's EVP_PKEY_derive. However, with OpenSSL 1.1.x, algorithms such as X25519, X448, DH, and HKDF-extract ignore this incoming key length and write the full shared secret (32 or 56 bytes, or prime size bytes) regardless. This leads to a heap or stack overflow when a caller provides a short buffer slice. OpenSSL 3.x providers properly check the length, limiting the issue to older OpenSSL versions. The vulnerability corresponds to CWE-131 (Incorrect Calculation of Buffer Size) and CWE-787 (Out-of-bounds Write).
Attackers can exploit this remotely with low complexity and no privileges or user interaction required, as indicated by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation occurs when an application using the affected rust-openssl versions and OpenSSL 1.1.x invokes the vulnerable derive functions with an undersized buffer. A malicious actor controlling inputs to such an application—such as in a key derivation process during cryptographic operations—can trigger the overflow, potentially leading to arbitrary code execution, data corruption, or denial of service through high-impact confidentiality, integrity, and availability violations.
The rust-openssl security advisory at https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5 details the issue and confirms the fix in version 0.10.78, recommending immediate upgrades for affected users. Practitioners should verify OpenSSL versions in their Rust dependencies and audit code using these derive functions, especially in cryptographic libraries or applications handling key exchanges.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25582
Vulnerability Data
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519,…
more
X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer security testing and code review can discover incorrect buffer-size computations before deployment.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Secure engineering principles directly require correct buffer-size arithmetic and bounds-checked allocation.
Input validation can enforce that supplied lengths or counts used in size calculations are within safe bounds.
Memory-protection mechanisms limit the exploitability of an overflow that results from an incorrect size calculation.
Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent buffer-size miscalculations via coding standards, reviews, and testing, while fixing this single weakness only partially fulfills the broader control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require correct buffer-size calculations.
Security testing can detect buffer-size errors before release.
Secure development lifecycle mandates size-checking practices that reduce buffer-size miscalculations.
Application security requirements can specify buffer-size validation rules.
Secure architecture principles include safe memory-allocation guidelines.
Change management can enforce review gates that catch unsafe memory operations before deployment.