CVE-2026-45784
Description
A flaw was found in rust-openssl, a library providing OpenSSL bindings for the Rust programming language. When processing data with AES key-wrap-with-padding ciphers, the library incorrectly calculates the size of output buffers. This error can lead to memory corruption, where OpenSSL writes beyond the intended buffer boundaries. An attacker capable of influencing the input data's length could exploit this to cause a denial of service or potentially corrupt data.
Statement
This Moderate flaw in rust-openssl can lead to heap corruption when processing data with AES key-wrap-with-padding ciphers. An attacker able to influence the plaintext length could trigger an out-of-bounds write, potentially causing a denial of service or data integrity issues. Exploitation requires the use of these specific ciphers, limiting the attack surface.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
