CVE-2026-34182 in OpenSSL 3.6.2

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the ciph

Severity

Critical 9.1

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 3.6.3

Where

Workstation tool

How it matched

Exact version match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-34182