CVE-2026-28386
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Out-of-bounds read in OpenSSL when using AES-CFB128 on systems with AVX-512 and VAES. May cause application crash (DoS) under specific conditions.
Risk Assessment
An attacker could crash applications using OpenSSL with AES-CFB128, leading to denial of service. No data disclosure risk.
Recommendation
Update OpenSSL to a patched version (e.g., 3.6.x with fix). Avoid using AES-CFB128 if possible.
Other vulnerabilities in OpenSSL
See all- CVE-2016-8610High
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
- CVE-2017-3731High
CVE-2017-3731 affects SSL/TLS servers and clients running on 32-bit hosts that may crash due to an out-of-bounds read caused by a truncated packet. For OpenSSL 1.1.0, the crash can be triggered using the CHACHA20/POLY1305 cipher, and for OpenSSL 1.0.2 using RC4-MD5.
- CVE-2017-3730High
In OpenSSL 1.1.0 before 1.1.0d, a malicious server can supply bad parameters for a DHE or ECDHE key exchange, leading to the client attempting to dereference a NULL pointer, resulting in a client crash.
- CVE-2016-7054High
In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash.
- CVE-2016-7052High
OpenSSL 1.0.2i has a vulnerability that allows remote attackers to cause application crashes by triggering a CRL operation, leading to a NULL pointer dereference.
- CVE-2016-6305High
The ssl3_read_bytes function in OpenSSL 1.1.0 before version 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.
- CVE-2016-6304High
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
- CVE-2016-6302High
The tls_decrypt_ticket function in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, allowing remote attackers to cause a denial of service via a ticket that is too short.
- CVE-2016-2179High
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously.
- CVE-2016-2176High
The X509_NAME_oneline function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
Original NVD description (English source)
Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not written to output. The vulnerable code path is only reached when processing partial blocks (when a previous call left an incomplete block and the current call provides fewer bytes than needed to complete it). Additionally, the input buffer must be positioned at a page boundary with the following page unmapped. CFB mode is not used in TLS/DTLS protocols, which use CBC, GCM, CCM, or ChaCha20-Poly1305 instead. For these reasons the issue was assessed as Low severity according to our Security Policy. Only x86-64 systems with AVX-512 and VAES instruction support are affected. Other architectures and systems without VAES support use different code paths that are not affected. OpenSSL FIPS module in 3.6 version is affected by this issue.