Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-10T00:00:00 openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-805

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email address. This could cause the 64 octet limit on the local part of an email address to be not enforced, or cause an out of bound read and potentially a crash. The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

A flaw was found in OpenSSL. When an application uses the X509_VERIFY_PARAM_set1_email() function to validate a specially crafted S/MIME (Secure/Multipurpose Internet Mail Extensions) email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious email, leading to an application crash and a Denial of Service (DoS). This issue does not directly expose sensitive data.

This flaw is rated as Low impact. A possible out-of-bounds read in OpenSSL's X509_VERIFY_PARAM_set1_email() function can occur when an application validates a specially crafted S/MIME email address. This could lead to a denial of service through an application crash, but does not directly exfiltrate data. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred edk2 Red Hat Enterprise Linux 10 Fix deferred openssl Red Hat Enterprise Linux 10 Fix deferred shim Red Hat Enterprise Linux 10 Fix deferred shim-unsigned-aarch64 Red Hat Enterprise Linux 10 Fix deferred shim-unsigned-x64 Red Hat Enterprise Linux 6 Fix deferred openssl Red Hat Enterprise Linux 7 Fix deferred ovmf Red Hat Enterprise Linux 8 Fix deferred compat-openssl10 Red Hat Enterprise Linux 8 Fix deferred edk2 Red Hat Enterprise Linux 8 Fix deferred mingw-openssl Red Hat Enterprise Linux 8 Fix deferred openssl Red Hat Enterprise Linux 8 Fix deferred shim Red Hat Enterprise Linux 8 Fix deferred shim-unsigned-x64 Red Hat Enterprise Linux 9 Out of support scope compat-openssl11 Red Hat Enterprise Linux 9 Fix deferred edk2 Red Hat Enterprise Linux 9 Not affected openssl Red Hat Enterprise Linux 9 Fix deferred shim Red Hat Enterprise Linux 9 Fix deferred shim-unsigned-aarch64 Red Hat Enterprise Linux 9 Fix deferred shim-unsigned-x64 Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-42771 https://nvd.nist.gov/vuln/detail/CVE-2026-42771