CVE-2026-7383

Deeper analysis

CVE-2026-7383 is a signed integer overflow vulnerability in OpenSSL's ASN1_mbstring_ncopy() and ASN1_mbstring_copy() functions. The flaw occurs when computing the destination buffer size for Unicode output formats such as BMPSTRING, UNIVERSALSTRING, or UTF8STRING, where left shifts or per-character byte summations on large inputs cause the signed int calculation to wrap, resulting in an undersized heap allocation via OPENSSL_malloc() followed by an out-of-bounds write during character copying. The affected code lies outside the FIPS module boundary in versions 4.0, 3.6, 3.5, 3.4, and 3.0.

An attacker can trigger the heap buffer overflow only by supplying roughly half a gigabyte or more of attacker-controlled input directly to ASN1_mbstring_copy(), ASN1_mbstring_ncopy(), or a custom string type registered via ASN1_STRING_TABLE_add(). Standard X.509 certificate processing paths, including ASN1_STRING_set_by_NID() and DIRSTRING_TYPE handling, impose length limits that prevent the overflow, and no network protocol or certificate-handling code in OpenSSL exercises the vulnerable path. Successful exploitation could produce a crash or attacker-controlled code execution, though the issue received a Low severity rating because of these constraints.

Publicly referenced commits in the OpenSSL repository provide the corrective patches that address the integer overflow during buffer sizing. The FIPS modules remain unaffected. The current EPSS score of 0.0007 indicates minimal observed exploitation interest.