An out‑of‑bounds read occurs in the CMS password‑based decryption routine when an attacker supplies CMS data and selects a stream‑mode key‑unwrap algorithm. The key unwrapping function reads seven bytes past a heap allocation that is sized based on the wrapped key length, a guard that is ineffective for stream ciphers. This results in a small buffer over‑read that can trigger a crash if the allocation ends at an unmapped page boundary. The vulnerability does not leak data; the read bytes are never returned to the attacker. The weakness is classified as CWE‑125.

The affected product is OpenSSL, specifically the CMS decryption functionality exposed through the CMS_decrypt and CMS_decrypt_set1_password APIs (and the openssl cms command). No specific version ranges are provided in the data, so any OpenSSL installation that includes the vulnerable CMS implementation is potentially impacted.

The exploit describes a crash rather than code execution or data disclosure. An attacker does not need to know the decryption password; the failure occurs during key unwrapping before authentication succeeds. While the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the CVSS score of 7.5 indicates a high severity risk, and the potential for denial of service in any application using CMS decryption on untrusted data makes the risk significant. Exploitation would require the attacker to provide malformed CMS data to the vulnerable library, typically through protocols or tools that invoke CMS_decrypt.