{"id":16314,"date":"2026-09-04T19:05:16","date_gmt":"2026-09-04T11:05:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-7383"},"modified":"2026-09-04T19:05:16","modified_gmt":"2026-09-04T11:05:16","slug":"cve-2026-7383","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-7383","title":{"rendered":"CVE-2026-7383 [HIGH] &#8211; Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode ou"},"content":{"rendered":"<p>Issue summary: A signed integer overflow when sizing the destination<br \/>\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap<br \/>\nbuffer overflow.<\/p>\n<p>Impact summary: A heap buffer overflow may lead to a crash or possibly<br \/>\nattacker controlled code execution or other undefined behaviour.<\/p>\n<p>In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination<br \/>\nsize for Unicode output is computed in a signed int: by left shift<br \/>\nof the input character count for BMPSTRING (UTF-16) and<br \/>\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts<br \/>\nfor UTF8STRING. The calculation overflows when the input reaches<br \/>\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30<br \/>\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and<br \/>\nthe subsequent character copy writes several gigabytes past the<br \/>\none-byte allocation.<\/p>\n<p>X.509 certificate processing routes through ASN1_STRING_set_by_NID(),<br \/>\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID<br \/>\nsize limits cap the input length; no network protocol or<br \/>\ncertificate-handling path in OpenSSL exercises the overflow.<br \/>\nTriggering the bug requires an application that calls<br \/>\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers<br \/>\na custom string type via ASN1_STRING_TABLE_add(), with<br \/>\nattacker-controlled input on the order of half a gigabyte or more.<br \/>\nFor these reasons this issue was assigned Low severity.<\/p>\n<p>The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by<br \/>\nthis issue, as the affected code is outside the OpenSSL FIPS module<br \/>\nboundary.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Issue summary: A signed integer overflow when sizing the destination<br \/>\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap<br \/>\nbuffer overflow.<\/p>\n<p>Impact summary: A heap buffer overflow may <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16314","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}