CVE-2026-45784Exploit(sfackler / openssl)

MEDIUMCVSS 7.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch sfackler openssl systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.

sfackler CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Other references

https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.80

Weakness type (CWE)

CWE-131CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openssl

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

sfackler

Products

openssl

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Exploit

1100.0%

Referenced assets1 URL

By indicator

https://github.com/advisories/GHSA-phqj-4mhp-q6mq

Full discourse1 post

Ali Firas | The Smart Shadow@thesmartshadow_46d
Exploit
They marked it fixed. I tested the fix. The result was another CVE and a working exploit chain: attacker-controlled heap corruption in rust-openssl, alive for 3+ years across 53 downstream products. CVE-2026-45784 Ali Firas | @thesmartshadow https://github.com/advisories/GHSA-phqj-4mhp-q6mq https://t.co/M2fLuqYkIy
Post summary
The tweet claims that a newly reported CVE-2026-45784, featuring attacker-controlled heap corruption in rust‑openssl, has a working exploit chain; the vendor has released a fix which the user tested.
0001069
16 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sfackler	openssl	-	rust	-

Explore more

Back to dashboard sfackler CVEs openssl vulnerabilities