OpenSSL flaw lets crafted CMS messages crash vulnerable services
OpenSSL 3.0, 3.3, 3.4, 3.5 and 3.6 contain a stack-based buffer overflow that can let a remote attacker crash a service and may permit remote code execution, according to a Siemens security advisory updated on November 10, 2026. The issue affects applications that parse untrusted CMS or PKCS#7 content with AEAD ciphers such as AES-GCM.
The flaw occurs while OpenSSL processes the initialization vector in a CMS AuthEnvelopedData or EnvelopedData message. Siemens said the value is copied into a fixed-size stack buffer without checking its length, so an oversized value can write beyond the buffer before authentication or tag verification takes place. An attacker therefore does not need valid key material to trigger the overflow.
Siemens listed several affected products and said it has released new versions for some of them. The company recommends updating those products to their latest versions and says it is preparing further fixes where updates are not yet available.
Where a fix is unavailable, Siemens recommends following the affected product's hardening guidance and avoiding files from untrusted, unvalidated sources. It also advises reviewing whether systems accept untrusted CMS or PKCS#7 content from external sources. For connected mail servers, Siemens recommends enforcing encrypted SMTP connections, restricting access to trusted systems and keeping the mail server and operating system patched.
OpenSSL 1.1.1 and 1.0.2 are not affected by this specific issue, according to Siemens. The CERT-Bund advisory describes the broader OpenSSL disclosure as allowing information disclosure, file manipulation or denial-of-service attacks, while noting that other effects were not specified.