Rust‑openssl provides Rust bindings to OpenSSL. From versions 0.9.27 to 0.10.77, Deriver::derive (and PkeyCtxRef::derive) sets a length equal to the supplied buffer size and passes it to EVP_PKEY_derive. On OpenSSL 1.1.x the key‑length parameter is ignored for X25519, X448, DH, and HKDF‑extract, which write the full shared secret unconditionally. When a caller provides a smaller slice, safe Rust code triggers a heap or stack overflow because data is written beyond the intended buffer limits, resulting in process‑local memory corruption.

The flaw affects the rust‑openssl crate versions 0.9.27 through 0.10.77 when linked against OpenSSL 1.1.x family releases (including 1.1.1). It does not apply to OpenSSL 3.x providers that perform the key‑length check.

The CVSS score of 7.2 indicates high severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local control of an application that calls Deriver::derive with an undersized buffer, leading to memory corruption within that process and potential instability or unexpected behavior.