5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44662

CVE-2026-44662: rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44662

CVE-2026-44662:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openssl	rust	>= 0.10.0, < 0.10.79	0.10.79

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a heap-based buffer overflow in the rust-openssl crate, occurring during encryption with AES key-wrap-with-padding ciphers. The root cause was an incorrect calculation of the required output buffer size in the CipherCtxRef::cipher_update and CipherCtxRef::cipher_update_vec functions.

The original code allocated a buffer of size input.len() + block_size. However, for AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad), the OpenSSL library can write up to input.len() + 15 bytes in a single update operation, especially when the input length is not a multiple of 8. This discrepancy meant the allocated buffer could be up to 7 bytes too small, causing the underlying EVP_CipherUpdate call to write past the buffer's boundary, leading to heap corruption.

The patch, identified in commit 257f9b20c001b888986f93579f118fa2a57d4f45, rectifies this by introducing a new function, cipher_update_output_size. This function checks if a wrap-mode cipher is being used. If so, it calculates a correct, larger buffer size using the formula input_len.saturating_add(7) / 8 * 8 + 8. This ensures the buffer is always large enough to accommodate the entire output from OpenSSL, thus preventing the overflow. The vulnerable functions cipher_update and cipher_update_vec were updated to use this new sizing logic.

Vulnerable functions

CipherCtxRef::cipher_update

openssl/src/cipher_ctx.rs

This function was vulnerable because it calculated an output buffer size that was too small for AES key-wrap-with-padding ciphers. The original calculation `input.len() + block_size` did not account for the extra padding and IV that these specific ciphers add, which could be up to 15 bytes more than the input length. This undersized buffer could lead to a heap buffer overflow when the underlying OpenSSL library writes past the buffer's boundary.

CipherCtxRef::cipher_update_vec

openssl/src/cipher_ctx.rs

This function provides a convenient way to handle encryption output by automatically resizing a `Vec<u8>`. It was vulnerable because it used the same incorrect logic as `cipher_update` to determine the new size of the vector. By calling `output.resize(base + input.len() + self.block_size(), 0)`, it allocated insufficient space, making the subsequent call to `cipher_update` vulnerable to a heap buffer overflow.

symm::Crypter::update

openssl/src/symm.rs

`symm::Crypter` is a type alias for `CipherCtx`, and its `update` method is a wrapper around `CipherCtxRef::cipher_update`. Therefore, it directly exposes the same heap buffer overflow vulnerability. When a user calls `Crypter::update` with an AES key-wrap-with-padding cipher, the incorrect buffer sizing occurs, leading to potential heap corruption if the input data length is not a multiple of 8.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.