CVE-2026-44662— rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding

rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.

N/A

堆缓冲区溢出

rust-openssl 安全漏洞

rust-openssl是rust-openssl开源的一个用于与 OpenSSL 库进行交互的库。 rust-openssl 0.10.0版本至0.10.79之前版本存在安全漏洞，该漏洞源于使用AES密钥包装填充密码时输出缓冲区大小计算错误，可能导致攻击者控制的堆损坏。

N/A

N/A