# CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption

> An attacker can cause a denial of service in applications using OpenSSL CMS decryption by triggering a heap out-of-bounds read via crafted data.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 9 Jun 2026
- **Updated:** 10 Jun 2026
- **Also known as:** ALPINE-CVE-2026-9076, AZL-89790, AZL-89873, AZL-89934, BELL-CVE-2026-9076, DEBIAN-CVE-2026-9076, GHSA-q98x-73c3-57gj, JLSEC-2026-1156, MINI-6334-6fm6-p3cv, MINI-vv3h-fjjg-2373, ROOT-OS-ALPINE-315-CVE-2026-9076, ROOT-OS-ALPINE-317-CVE-2026-9076, UBUNTU-CVE-2026-9076

## What is CVE-2026-9076?

CVE-2026-9076 is a high-severity memory corruption vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK
cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

Impact summary: A heap buffer over-read may trigger a crash which leads to
Denial of Service for an application if the input buffer ends at a memory
page boundary and the following page is unmapped. There is no information
disclosure as the over-read bytes are not revealed to the attacker.

The key unwrapping function performs a check-byte test as specified in the
RFC that reads 7 bytes from a heap allocation that is based on the wrapped
key length from the message. There is a minimum length check based on the
block length of the wrapping cipher. However the cipher is selected from
an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no
requirement that the cipher be a block cipher. When an attacker selects
a stream-mode cipher the guard will be ineffective and the allocated buffer
containing the unwrapped key can be too small to fit the check-bytes
specified in the RFC and a buffer over-read can happen.

Applications calling CMS_decrypt() or CMS_decrypt_set1_password()
(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS
data are vulnerable to this issue. No password knowledge is required: the
over-read happens during the unwrap attempt before any authentication
succeeds.

The over-read is limited to a few bytes and is not written to output, so
there is no information disclosure. Triggering a crash requires the
allocation to border unmapped memory, which is unlikely with the normal
allocator.

The FIPS modules are not affected by this issue.

Weakness: CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-9076?

It affects 1 product.


Products: Openssl Openssl.

## How do I fix CVE-2026-9076?

Apply the vendor's patch.

## Is CVE-2026-9076 being exploited?

There is no known exploitation of CVE-2026-9076 in the wild and no public exploit code.

## Other vulnerabilities in Openssl Openssl

- [CVE-2009-3245](https://insights.sbomify.com/CVE-2009-3245/): Null dereference in n/a (critical 10.0)
- [CVE-2006-3738](https://insights.sbomify.com/CVE-2006-3738/): Memory corruption in n/a (critical 10.0)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2016-6309](https://insights.sbomify.com/CVE-2016-6309/): Use after free in n/a (critical 9.8)
- [CVE-2016-0799](https://insights.sbomify.com/CVE-2016-0799/): Integer overflow in n/a (critical 9.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-9076 and fix it if it is affected.

What it is: CVE-2026-9076 is a high-severity memory corruption vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-9076 in the wild and no public exploit code.

Affected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-9076/ (Markdown: https://insights.sbomify.com/CVE-2026-9076/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-9076
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9076
- OSV: https://osv.dev/vulnerability/CVE-2026-9076

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-9076/
Summaries are generated and may contain mistakes; the official description above is the record.