An uncommon configuration of DANE TLSA records can cause a use‑after‑free or double‑free in OpenSSL client code. The vulnerability occurs when a client processes TLSA records that use both PKIX-TA/EE and DANE-TA certificate usages. The resulting memory corruption may invalidate data structures, crash the program, or allow an attacker to execute arbitrary code. The weakness is a classic example of improper memory handling.

Computers running OpenSSL are affected. The CVE document does not list specific version numbers; affected systems use TLSA chains that contain both PKIX and DANE usages. Clients that ignore either family of TLSA record types or that never process TLSA records are not vulnerable.

The CVSS score is 8.1, indicating a high severity assessment, and the EPSS score is below 1 %, suggesting very low exploitation likelihood. The vulnerability is not currently included in the CISA KEV catalog. Exploitation would require a malicious server that provides a TLSA record set containing both PKIX and DANE usage types to a vulnerable client, which is an uncommon deployment scenario. The lack of a public exploit and the necessity of a specific cryptographic configuration reduce the immediate threat, but the potential for arbitrary code execution warrants timely remediation.