Parsing a crafted DER-encoded ASN.1 structure that declares a primitive element longer than 2 gigabytes causes OpenSSL to read far beyond the end of the input buffer. The integer truncation flaw makes the decoder treat the overflow as a request for a terminating zero byte, which can result in an over‑read of memory, possible data leakage, or an application crash. The over‑read may not always terminate the buffer, instead simply truncating the value and corrupting the decoded object.

The flaw affects OpenSSL libraries installed on 64‑bit Unix and Unix‑like operating systems. Any application that invokes d2i_X509, d2i_PKCS7, or other d2i_* decoding functions is vulnerable. The OpenSSL command‑line tools are safe because they validate input before reaching the vulnerable code. FIPS modules in versions 4.0, 3.6, 3.5, 3.4 and 3.0 are not, nor are 32‑bit platforms or 64‑bit Windows.

An attacker can deliver a malicious ASN.1 message through a network connection, file input, or other channel that is parsed by an OpenSSL‑dependent program. The exploit would trigger the heap over‑read, potentially causing a denial of service or leaking data that lies just beyond the input buffer. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.5 indicates a high severity, confirming that the large input length requirement and the potential for memory disclosure represent a serious risk if the vulnerable functions are exposed. Based on the description, the likely attack vector involves crafted input delivered to the vulnerable decoding routines.