Heap-based Buffer Overflow Affecting openssl package, versions >=0.10.50 <0.10.80
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Heap-based Buffer Overflow vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-OPENSSL-16770028
- published20 May 2026
- disclosed19 May 2026
- creditAli Firas
Introduced: 19 May 2026
NewCVE-2026-45784 (opens in a new tab)How to fix?
Upgrade openssl to version 0.10.80 or higher.
Overview
openssl is a bindings for the Rust programming language.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the CipherCtxRef::cipher_update_inplace() function when handling AES key-wrap-with-padding ciphers. An attacker can cause heap corruption by providing a plaintext length that is not a multiple of 8, resulting in up to 7 bytes being written past the end of the output buffer.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-44662.