CVE-2026-41678 rust-openssl CVE debrief

Who should care

Users of the Rust-OpenSSL library, particularly those using versions before 0.10.78, should be aware of this vulnerability and take steps to mitigate it. This includes developers and security teams responsible for maintaining and securing applications that utilize the rust-openssl library. They should review their dependencies, assess their exposure, and plan for updates or mitigations as necessary.

Technical summary

The rust-openssl library provides OpenSSL bindings for the Rust programming language. In versions before 0.10.78, the aes::unwrap_key() function contains an incorrect assertion. The function checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided, the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function.

Defensive priority

High

Recommended defensive actions

• Update to version 0.10.78 or later
• Review and validate input buffer sizes
• Implement additional monitoring and logging
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. The vendor advisory on GitHub provides additional context and mitigation steps. Users should verify the affected versions and configurations, review the code changes in the fix, and assess their exposure. Evidence is limited to public sources and may not cover all affected deployments. Defenders should focus on updating to version 0.10.78 or later and review input buffer sizes.

Official resources