Openssl: Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. (CVE-2026-31789)
A heap buffer overflow vulnerability exists in OpenSSL on 32-bit platforms when converting an excessively large OCTET STRING value to a hexadecimal string. This occurs due to integer overflow in buffer size calculation when processing crafted X.509 certificates with large OCTET STRING extensions such as Subject Key Identifier or Authority Key Identifier. Exploitation may lead to crashes or potentially attacker-controlled code execution. The vulnerability requires certificates larger than 1 GB, making exploitation unlikely. The issue does not affect OpenSSL FIPS modules. Fixes are available in updated OpenSSL packages for Ubuntu releases.
AI Analysis
Technical Summary
CVE-2026-31789 describes a heap buffer overflow in OpenSSL on 32-bit platforms caused by integer overflow during conversion of large OCTET STRING values to hexadecimal strings. The buffer size is calculated as input length multiplied by three, which can overflow and cause allocation of a smaller buffer than needed. This vulnerability affects applications that print or log untrusted X.509 certificates with excessively large OCTET STRING extensions such as SKID or AKID. The vulnerability is rated low severity due to the requirement for extremely large certificates (over 1 GB) and limited to 32-bit platforms. The OpenSSL FIPS modules are not affected. Ubuntu has released patches fixing this issue in OpenSSL versions 3.0.2-0ubuntu1.23, 3.0.13-0ubuntu3.9, and 3.5.3-1ubuntu3.3 among others.
Potential Impact
A heap buffer overflow may cause application crashes or potentially allow attacker-controlled code execution or other undefined behavior on 32-bit platforms. The vulnerability specifically impacts processing of crafted X.509 certificates with very large OCTET STRING extensions. Due to the large certificate size requirement and platform limitation, the practical risk is low. The OpenSSL FIPS modules are unaffected.
Mitigation Recommendations
A patch is available and should be applied to affected OpenSSL versions. Ubuntu users should update to OpenSSL package versions 3.0.2-0ubuntu1.23 or later for 22.04 LTS, 3.0.13-0ubuntu3.9 or later for 24.04 LTS, and 3.5.3-1ubuntu3.3 or later for 25.10. After updating, a system reboot is recommended to ensure all changes take effect. No additional mitigation is required beyond applying the official fixes.
Openssl: Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. (CVE-2026-31789)
Description
A heap buffer overflow vulnerability exists in OpenSSL on 32-bit platforms when converting an excessively large OCTET STRING value to a hexadecimal string. This occurs due to integer overflow in buffer size calculation when processing crafted X.509 certificates with large OCTET STRING extensions such as Subject Key Identifier or Authority Key Identifier. Exploitation may lead to crashes or potentially attacker-controlled code execution. The vulnerability requires certificates larger than 1 GB, making exploitation unlikely. The issue does not affect OpenSSL FIPS modules. Fixes are available in updated OpenSSL packages for Ubuntu releases.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-31789 describes a heap buffer overflow in OpenSSL on 32-bit platforms caused by integer overflow during conversion of large OCTET STRING values to hexadecimal strings. The buffer size is calculated as input length multiplied by three, which can overflow and cause allocation of a smaller buffer than needed. This vulnerability affects applications that print or log untrusted X.509 certificates with excessively large OCTET STRING extensions such as SKID or AKID. The vulnerability is rated low severity due to the requirement for extremely large certificates (over 1 GB) and limited to 32-bit platforms. The OpenSSL FIPS modules are not affected. Ubuntu has released patches fixing this issue in OpenSSL versions 3.0.2-0ubuntu1.23, 3.0.13-0ubuntu3.9, and 3.5.3-1ubuntu3.3 among others.
Potential Impact
A heap buffer overflow may cause application crashes or potentially allow attacker-controlled code execution or other undefined behavior on 32-bit platforms. The vulnerability specifically impacts processing of crafted X.509 certificates with very large OCTET STRING extensions. Due to the large certificate size requirement and platform limitation, the practical risk is low. The OpenSSL FIPS modules are unaffected.
Mitigation Recommendations
A patch is available and should be applied to affected OpenSSL versions. Ubuntu users should update to OpenSSL package versions 3.0.2-0ubuntu1.23 or later for 22.04 LTS, 3.0.13-0ubuntu3.9 or later for 24.04 LTS, and 3.5.3-1ubuntu3.3 or later for 25.10. After updating, a system reboot is recommended to ensure all changes take effect. No additional mitigation is required beyond applying the official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-31789
- Cve Count
- 1
Threat ID: 6a1ca158e29bf47b505e1e36
Added to database: 05/31/2026, 21:00:08 UTC
Last enriched: 08/03/2026, 00:42:39 UTC
Last updated: 09/12/2026, 22:01:33 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.