← Vulnerability feed

Vulnerability record · CVE-2026-41681 · published 24 April 2026

CVE-2026-41681: Rust-openssl project rust-openssl stack-based buffer overflow vulnerability

RRust Openssl Project · Rust Openssl

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

8.1 CVSS 4.0 High EPSS 0.36% · top 72.8% CWE-121 · Stack-based buffer overflow
8.1CVSS 4.0 base score
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
15 Jul 2026Last modified by NVD

Description

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/rust-openssl/rust-openssl/commit/826c3888b77add418b394770e2b2e3a72d9f92fe Patch
https://github.com/rust-openssl/rust-openssl/pull/2608 Issue Tracking
https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78 Release Notes
https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-ghm9-cr32-g9qj Vendor Advisory

Track CVE-2026-41681 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-20997Rust-openssl project rust-openssl use after free vulnerabilityAn issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.EPSS 1.7%8.3CVE-2026-41898Rust-openssl project rust-openssl vulnerabilityrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder…EPSS 0.28%8.1CVE-2016-10931Rust-openssl project rust-openssl improper certificate validation vulnerabilityAn issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verificat…EPSS 0.75%7.2CVE-2026-41676Rust-openssl project rust-openssl out-of-bounds write vulnerabilityrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) set…EPSS 0.29%7.2CVE-2026-41678Rust-openssl project rust-openssl out-of-bounds write vulnerabilityrust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: …EPSS 0.25%1.7CVE-2026-41677Rust-openssl project rust-openssl out-of-bounds read vulnerabilityrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate…EPSS 0.29%8.8CVE-2026-7273Zyxel gs1900-8 firmware stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-base…KEVEPSS 2.5%8.1CVE-2021-27137DD-WRT UPnP M-SEARCH stack buffer overflowDD-WRT before 45724 contains an unsafe strcpy in the UPnP SSDP handling code (ssdp_msearch), reachable via an M-SEARCH request, that overflows a fixe…KEVEPSS 4.0%analysed

Source: NIST National Vulnerability Database (record CVE-2026-41681), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.