A memory corruption vulnerability in the OpenSSL CMS decryption process poses a risk of remote code execution or denial of service for affected applications.

This flaw involves out-of-bounds read and write operations during the decryption of Cryptographic Message Syntax (CMS) messages using password based encryption. The vulnerability is unauthenticated and can be triggered when an application attempts to process malicious CMS data.

The potential for memory corruption and arbitrary code execution creates a significant security risk for any service relying on OpenSSL for CMS message processing. While the CVSS score of 7.5 indicates high severity, the vendor notes that the specific use of password based encryption in CMS is rare, which may lower the practical probability of exploitation in most environments. Successful exploitation could lead to full system compromise or service unavailability, necessitating timely patching.

Immediate Action: Update all instances of OpenSSL to the latest patched versions (e.g., 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd, or 1.0.2zm) as specified by the vendor advisory.

Proactive Monitoring: Review application logs for unusual crashes or unexpected process terminations, which may indicate attempted exploitation of memory corruption flaws.

Compensating Controls: Ensure that applications are run with the principle of least privilege to limit the impact of potential code execution and utilize memory protection features provided by the host operating system.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations should prioritize updating their OpenSSL libraries to the recommended versions. Although the specific attack vector is infrequently used, the severity of the impact warrants a proactive approach to remediation within the standard patch management cycle.