PT-2026-47841 · Openssl · Openssl

Bob Beck · CVE-2026-42771 · Published 2026-06-09 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An out-of-bounds read occurs when an application calls the X509 VERIFY PARAM set1 email function to validate a crafted email address, such as during S/MIME message validation. This issue stems from an internal helper function called by X509 VERIFY PARAM set1 email() and X509 VERIFY PARAM add email() that uses an incorrect length when validating the local part of an email address. Consequently, the 64-octet limit for the local part may not be enforced, potentially leading to a crash and Denial of Service. The flaw is reachable via S-MIME validation using a crafted From: address in an email message.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-42771

ZDI-26-426

Affected Products

Openssl

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42771.json · Exploit
• https://github.com/openssl/openssl/commit/6cd187689f8180c1f8a3acde21f88190c4a20de7 · Patch
• https://openssl-library.org/news/secadv/20260609.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42771 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-426 · Security Note
• https://ubuntu.com/security/CVE-2026-42771 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42771 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42771 · Security Note
• ❌ https://github.com/openssl/security/commit/6cd187689f8180c1f8a3acde21f88190c4a20de7 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-42771 · Security Note
• https://t.me/CVEtracker/56320 · Telegram Post