Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111458— ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting

Quick assessment

Affected
adulau ssldump
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ssldump 工具中 ssl/sslxprint.c 文件的 fanx_fingerprint 函数在为 FAN/1 格式的 X.509 证书指纹生成格式化字符串时，分配了一个堆缓冲区。该函数计算缓冲区大小时使用了 ，然而实际使用的格式字符串 除了两个可变长度字段和一个空终止符外，还包含 33 个固定字符，因此实际需要的缓冲区大小应为 字节。这一计算错误导致该函数在每次以有效输入被调用时，都会发生 3 字节的基于堆的缓冲区溢出。 溢出产生的原因是 函数在未进行边界检查的情况下，将完整的格式化字符串写入尺寸不足的堆

CVSS 6.8 · Medium EPSS 0.09% · P1

Affected Version Matrix 1

VendorProduct Version RangeStatus
adulau ssldump ≤ 1.9.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111458

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
Source: CVE Program / CVE List V5
Vulnerability Description
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
adulau ssldump 0 ~ 1.9.0 cpe:2.3:a:adulau:ssldump:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-111458

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111458

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111458 (1)

IV. Related Vulnerabilities

Same weakness: CWE-122

V. Comments for CVE-2026-111458

No comments yet

Leave a comment