An out‑of‑bounds read occurs in the OpenSSL function X509_VERIFY_PARAM_set1_email when validating the local part of an email address. The bug allows an attacker to supply a specially crafted From: header that bypasses the 64‑octet limit or reads past the buffer. Because the data read is not exposed, the primary consequence is a crash, resulting in a denial of service for any application performing S/MIME validation.

The vulnerability affects installations of OpenSSL OpenSSL 4.0.0 that use X509_VERIFY_PARAM_set1_email during S/MIME or X.509 email address validation. Systems running this version without the patch are potentially vulnerable.

The EPSS score is < 1% and the issue is not listed in CISA KEV, indicating no known active exploitation. The CVSS score is 6.2, indicating medium severity; the risk is moderate for denial of service. The likely attack vector is network‑based, where an attacker sends a crafted email to a service performing S/MIME validation, causing a crash. Because no data is exfiltrated, the threat is limited to service interruption.