High-severity OpenSSL flaw can leak memory or crash programs

As reported by The Hacker News, a high-severity vulnerability has been identified in OpenSSL, a widely used cryptographic library. This flaw, designated CVE-2026-84782, poses a significant risk as it can lead to the leakage of sensitive heap memory or cause application crashes within systems utilizing the DTLS protocol.

The vulnerability arises in the Datagram Transport Layer Security (DTLS) protocol, a variant of TLS used for UDP traffic. When DTLS resends handshake messages due to a timeout while a larger handshake message is partially sent, the flaw can be triggered. Instead of restarting the message, the resend process uses paused data, potentially leading to a buffer overrun. This can result in heap memory being exposed as unencrypted handshake data or cause a program to crash if it attempts to read unmapped memory.

OpenSSL has released fixes in versions 4.0.3, 3.6.5, 3.5.9, and 3.4.8. However, older branches like 3.0, 1.1.1, and 1.0.2 only receive fixes for customers with premium support, as public security updates for OpenSSL 3.0 ceased on September 7. While OpenSSL has not confirmed any exploitation in the wild, the flaw affects both DTLS clients and servers. DTLS is employed in technologies like WebRTC data channels and internet call encryption, making any software using OpenSSL for DTLS potentially vulnerable. CISA assigned the flaw a CVSS score of 8.2, emphasizing its high impact on availability.

Source: The Hacker News