CVE-2021-3711: OpenSSL SM2 decryption buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score make this a top patching priority despite no KEV listing.

What it is

OpenSSL's SM2 decryption code miscalculates the output buffer size needed by EVP_PKEY_decrypt(), so the first sizing call can return a value smaller than the plaintext actually produced on the second call. An application that allocates based on that first call then passes a too-small buffer, and the subsequent write overflows it by up to 62 bytes. This affects OpenSSL 1.1.1 through 1.1.1k and is fixed in 1.1.1l.

Impact

An attacker who can supply SM2 ciphertext for decryption can overwrite up to 62 bytes past a typically heap-allocated buffer, corrupting adjacent data, altering application behavior, or crashing the process. The CVSS vector rates confidentiality, integrity and availability all High, though the record does not demonstrate code execution.

Attack surface

Reached remotely over the network with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but only where an application actually performs SM2 decryption on attacker-supplied content. Applications that never call EVP_PKEY_decrypt() with SM2 keys are not exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.878 (99.75th percentile), indicating strong predicted exploitation pressure. References are advisories and patches only; none are tagged as exploit code.

What to do

• Upgrade OpenSSL to 1.1.1l or later, or apply the vendor patch for your distribution or product.
• Apply the linked vendor advisories for NetApp, Oracle, Debian, Gentoo, Siemens and Tenable products that bundle OpenSSL.
• If immediate patching is not possible, disable or avoid SM2 decryption paths that process untrusted ciphertext.
• Inventory applications and services that call EVP_PKEY_decrypt() with SM2 keys and prioritize them for patching.

Detection

• Search hosts and containers for OpenSSL versions 1.1.1 through 1.1.1k, including statically linked and bundled copies.
• Monitor for crashes or abnormal terminations in processes that perform SM2 decryption on external input.
• Watch for unexpected heap corruption indicators or memory errors in services handling SM2-encrypted data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.