A signed integer overflow occurs in the destination size calculation of the ASN1_mbstring_ncopy function, which is used for converting ASN.1 multibyte strings to Unicode format. The overflow can cause the allocated buffer to be far smaller than the data being copied, resulting in a heap buffer overflow. Depending on how the overflow is exploited, the application may crash or an attacker could potentially execute arbitrary code. This weakness is captured by CWE‑787: Buffer Access Using Size of Wrong Type.

The flaw exists in OpenSSL’s core library code that implements ASN.1 string handling. No version numbers are explicitly listed in the advisory, and the FIPS modules (4.0, 3.6, 3.5, 3.4, 3.0) are not affected. Therefore any OpenSSL deployment that links against the non‑FIPS code path and that may invoke ASN1_mbstring_copy or ASN1_mbstring_ncopy could be affected, especially if the application supplies very large string inputs.

The CVSS score of 8.1 indicates a high severity, and its EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires an application that explicitly calls the vulnerable conversion routine or registers a custom string type, with an input of roughly half a gigabyte or more. Because the overflow occurs only when processing exceptionally large inputs and no standard OpenSSL API path exposes the vulnerability, the real‑world likelihood of exploitation is small but not zero. Nevertheless, the potential impact of arbitrary code execution warrants proactive mitigation if the affected function is used.