CVE-2026-41681 HIGH

CVE-2026-41681: rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

Vendor Rust-Openssl
Product rust-openssl
Weakness CWE-121
Published April 24, 2026
Last update April 24, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

Key dates

02Disclosure timeline

April 24, 2026 CVE published
April 24, 2026 Record updated