OpenSSL X.509 OCTET STRINGHeap overflow on 32-bit
CVE-2026-31789 Published on April 7, 2026
Heap Buffer Overflow in Hexadecimal Conversion
Issue summary: Converting an excessively large OCTET STRING value to
a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.
Impact summary: A heap buffer overflow may lead to a crash or possibly
an attacker controlled code execution or other undefined behavior.
If an attacker can supply a crafted X.509 certificate with an excessively
large OCTET STRING value in extensions such as the Subject Key Identifier
(SKID) or Authority Key Identifier (AKID) which are being converted to hex,
the size of the buffer needed for the result is calculated as multiplication
of the input length by 3. On 32 bit platforms, this multiplication may overflow
resulting in the allocation of a smaller buffer and a heap buffer overflow.
Applications and services that print or log contents of untrusted X.509
certificates are vulnerable to this issue. As the certificates would have
to have sizes of over 1 Gigabyte, printing or logging such certificates
is a fairly unlikely operation and only 32 bit platforms are affected,
this issue was assigned Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-31789 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-31789
Want to know whenever a new CVE is published for OpenSSL? stack.watch will email you.
Affected Versions
OpenSSL:- Version 3.6.0 and below 3.6.2 is affected.
- Version 3.5.0 and below 3.5.6 is affected.
- Version 3.4.0 and below 3.4.5 is affected.
- Version 3.3.0 and below 3.3.7 is affected.
- Version 3.0.0 and below 3.0.20 is affected.