GCVE-110-NCSC-2026-441

Advisory PublishedCVSS 7.5/10

Vulnetix · Advisory published October 21, 2026

OpenSSL versions 3.0 to 3.6 contain a stack buffer overflow vulnerability in parsing CMS AuthEnvelopedData or EnvelopedData messages with malicious AEAD parameters, potentially leading to crashes or remote code execution, while versions 1.1.1 and 1.0.2 are unaffected.

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-787Out-of-bounds WriteCWE-347Improper Verification of Cryptographic Signature

Risk Scores

CVSS 3.1

7.5/10

High · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

Aliases

CVE-2025-15467 CVE-2026-101679 CVE-2026-101768 CVE-2026-101769 CVE-2026-101770 CVE-2026-101771 CVE-2026-101772 CVE-2026-101773 CVE-2026-101775 CVE-2026-101781 CVE-2026-101783 CVE-2026-101785 CVE-2026-101786 CVE-2026-101796 CVE-2026-101797 CVE-2026-101810 CVE-2026-83404 CVE-2026-9547

References

advisory

Browse GCVE Records

930 records in the GCVE database · Updated November 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON