{"id":"CVE-2026-7383","summary":"Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion","details":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary.","modified":"2026-07-25T08:12:08.275732Z","published":"2026-06-09T16:03:15.508Z","related":["ALSA-2026:25237","ALSA-2026:25239","CGA-9q73-qf7g-7g7m","SUSE-SU-2026:22100-1","SUSE-SU-2026:22132-1","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2392-1","SUSE-SU-2026:2393-1","SUSE-SU-2026:2396-1","SUSE-SU-2026:2397-1","SUSE-SU-2026:2399-1","SUSE-SU-2026:2403-1","SUSE-SU-2026:2404-1","SUSE-SU-2026:2405-1","SUSE-SU-2026:2598-1","SUSE-SU-2026:2614-1","SUSE-SU-2026:2648-1","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7383.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7383.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260609.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"fixed":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"introduced":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"fixed":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"introduced":"89cd17a031e022211684eb7eb41190cf1910f9fa"},{"fixed":"51ea949dc1436e865935b47874b21a3bb31a102e"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"c5ea1cc227fd60afae8ac4b9438690bbe4888f79"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"8cf17aaeb4599f8af87fefd810b5b5fee90fe69e"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f"},{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6"},{"fixed":"80c15faaf78042bbb8654a0e234c50c381732f74"},{"fixed":"bd17511070fb39a67bfa19682affb765e706a974"},{"fixed":"c332adaced43bcbb85f97410597e951c11ec3083"},{"fixed":"d32350ae8ef7426718f5aa9e383d4b51398ee255"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0.2"},{"fixed":"1.0.2zq"},{"introduced":"1.1.1"},{"fixed":"1.1.1zh"},{"introduced":"3.0.0"},{"fixed":"3.0.21"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.7"},{"introduced":"3.6.0"},{"fixed":"3.6.3"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"}]}}],"versions":["4.0.0-NA","openssl-4.0.0","openssl-3.0.20","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.0.19","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.0-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.0-PRE-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.0.18","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.0.17","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.0.16","openssl-3.4.1","openssl-3.4.0","openssl-3.0.15","openssl-3.0.14","openssl-3.0.13","openssl-3.0.12","openssl-3.0.11","openssl-3.0.10","openssl-3.0.9","openssl-3.0.8","openssl-3.0.7","openssl-3.0.6","openssl-3.0.5","openssl-3.0.4","openssl-3.0.3","openssl-3.0.2","openssl-3.0.1","openssl-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7383.json","vanir_signatures_modified":"2026-07-25T08:12:08Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","target":{"file":"crypto/asn1/a_mbstr.c"},"deprecated":false,"digest":{"line_hashes":["243971072618222724126117138392541085907","20203436555900253968670420024125559450","261033251671054815966464244630025010874","142558467251092045021326807845044327645","117558078243606577959089637136237792030","124332917225391423252605388545338682722","236022608503733170562534553288003810395","339832511801857794746629870610675811880","314277570596906803737453056118000261489","134443953973411113628429047361571354695","144241986910067820723321631094658024558","219027348492242387101505984291253252762","197249709654825572065845136116068698100","335442194952519091195796659076425621527","94024945373243508884955678864647600249","58865074517344503016033744066393422789","171075818861470609519508474684508188088","183308020435695821222991028080353540824","112766856209011567470513760761740501796"],"threshold":0.9},"id":"CVE-2026-7383-03cd20c7","signature_type":"Line"},{"target":{"file":"crypto/asn1/a_mbstr.c","function":"ASN1_mbstring_ncopy"},"deprecated":false,"digest":{"function_hash":"157368430457296408057518218641344868108","length":3297},"id":"CVE-2026-7383-1be3bd59","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","target":{"file":"crypto/asn1/a_mbstr.c","function":"out_utf8"},"deprecated":false,"digest":{"length":195,"function_hash":"326715636192485159031379249291784863467"},"id":"CVE-2026-7383-35f12443","signature_type":"Function"},{"target":{"file":"crypto/asn1/a_mbstr.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["243971072618222724126117138392541085907","20203436555900253968670420024125559450","261033251671054815966464244630025010874","142558467251092045021326807845044327645","117558078243606577959089637136237792030","124332917225391423252605388545338682722","236022608503733170562534553288003810395","339832511801857794746629870610675811880","314277570596906803737453056118000261489","134443953973411113628429047361571354695","144241986910067820723321631094658024558","219027348492242387101505984291253252762","197249709654825572065845136116068698100","335442194952519091195796659076425621527","94024945373243508884955678864647600249","58865074517344503016033744066393422789","171075818861470609519508474684508188088","183308020435695821222991028080353540824","112766856209011567470513760761740501796"]},"id":"CVE-2026-7383-53da0590","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255"},{"target":{"file":"crypto/asn1/a_mbstr.c","function":"out_utf8"},"deprecated":false,"digest":{"length":195,"function_hash":"326715636192485159031379249291784863467"},"id":"CVE-2026-7383-5a2e414f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","target":{"file":"crypto/asn1/a_mbstr.c"},"deprecated":false,"digest":{"line_hashes":["243971072618222724126117138392541085907","20203436555900253968670420024125559450","261033251671054815966464244630025010874","142558467251092045021326807845044327645","117558078243606577959089637136237792030","124332917225391423252605388545338682722","236022608503733170562534553288003810395","339832511801857794746629870610675811880","314277570596906803737453056118000261489","134443953973411113628429047361571354695","144241986910067820723321631094658024558","219027348492242387101505984291253252762","197249709654825572065845136116068698100","335442194952519091195796659076425621527","94024945373243508884955678864647600249","58865074517344503016033744066393422789","171075818861470609519508474684508188088","183308020435695821222991028080353540824","112766856209011567470513760761740501796"],"threshold":0.9},"id":"CVE-2026-7383-6d93e3cf"},{"deprecated":false,"digest":{"function_hash":"186349096673253037366471905327905215678","length":3172},"id":"CVE-2026-7383-6ea28808","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","target":{"file":"crypto/asn1/a_mbstr.c","function":"ASN1_mbstring_ncopy"}},{"target":{"file":"crypto/asn1/a_mbstr.c","function":"out_utf8"},"deprecated":false,"digest":{"length":195,"function_hash":"326715636192485159031379249291784863467"},"id":"CVE-2026-7383-6ecfcbdc","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","target":{"file":"crypto/asn1/a_mbstr.c"},"deprecated":false,"digest":{"line_hashes":["243971072618222724126117138392541085907","20203436555900253968670420024125559450","261033251671054815966464244630025010874","142558467251092045021326807845044327645","117558078243606577959089637136237792030","124332917225391423252605388545338682722","236022608503733170562534553288003810395","339832511801857794746629870610675811880","314277570596906803737453056118000261489","134443953973411113628429047361571354695","144241986910067820723321631094658024558","219027348492242387101505984291253252762","197249709654825572065845136116068698100","335442194952519091195796659076425621527","94024945373243508884955678864647600249","58865074517344503016033744066393422789","171075818861470609519508474684508188088","183308020435695821222991028080353540824","112766856209011567470513760761740501796"],"threshold":0.9},"id":"CVE-2026-7383-7397b06f"},{"deprecated":false,"digest":{"function_hash":"65331361705884786675178309567558276074","length":3109},"id":"CVE-2026-7383-810515e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","target":{"file":"crypto/asn1/a_mbstr.c","function":"ASN1_mbstring_ncopy"}},{"deprecated":false,"digest":{"function_hash":"65331361705884786675178309567558276074","length":3109},"id":"CVE-2026-7383-81b05481","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","target":{"file":"crypto/asn1/a_mbstr.c","function":"ASN1_mbstring_ncopy"}},{"id":"CVE-2026-7383-a18e4192","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","target":{"file":"crypto/asn1/a_mbstr.c","function":"out_utf8"},"deprecated":false,"digest":{"function_hash":"326715636192485159031379249291784863467","length":195}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86","target":{"file":"include/openssl/opensslv.h"},"deprecated":false,"digest":{"line_hashes":["28170854778703993674264004058177114599","73132526844288570625317440636111911761","177405411499435185068645597737938634778","224809958623850711330610094965797758930","295554444428855106393106961197201359586"],"threshold":0.9},"id":"CVE-2026-7383-c377fa22","signature_type":"Line"},{"id":"CVE-2026-7383-d050859d","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","target":{"file":"crypto/asn1/a_mbstr.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["243971072618222724126117138392541085907","20203436555900253968670420024125559450","261033251671054815966464244630025010874","142558467251092045021326807845044327645","117558078243606577959089637136237792030","124332917225391423252605388545338682722","236022608503733170562534553288003810395","339832511801857794746629870610675811880","314277570596906803737453056118000261489","134443953973411113628429047361571354695","144241986910067820723321631094658024558","219027348492242387101505984291253252762","197249709654825572065845136116068698100","335442194952519091195796659076425621527","94024945373243508884955678864647600249","58865074517344503016033744066393422789","171075818861470609519508474684508188088","183308020435695821222991028080353540824","112766856209011567470513760761740501796"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8","target":{"file":"crypto/opensslv.h"},"deprecated":false,"digest":{"line_hashes":["251633914150035957322733061977107206211","338514574181828579838011565939158652696","76638288692106140328510055542557597351","142922657400765574308962710386922248045","71649992455794854055653842592139575350","65527166711110472566013424527579064967","253196866009476977787139000804413898733","172177136897997206866313011107384691461"],"threshold":0.9},"id":"CVE-2026-7383-e051451f"},{"digest":{"function_hash":"157368430457296408057518218641344868108","length":3297},"id":"CVE-2026-7383-e999ea89","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","target":{"function":"ASN1_mbstring_ncopy","file":"crypto/asn1/a_mbstr.c"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","target":{"file":"crypto/asn1/a_mbstr.c","function":"out_utf8"},"deprecated":false,"digest":{"function_hash":"326715636192485159031379249291784863467","length":195},"id":"CVE-2026-7383-fb21566a","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}