CVE-2026-35188 is a remote code execution vulnerability in OpenSSL caused by a double free error during OCSP stapling verification. The vulnerability arises from a failure to validate the existence of an object before freeing it again when processing malformed OCSP responses. An attacker can exploit this by tricking a user into making a request to a malicious server, enabling arbitrary code execution in the context of the current process. The vulnerability has a CVSS score of 7.5 and is rated critical by the Zero Day Initiative. OpenSSL has released a patch to fix this issue.

Successful exploitation allows remote attackers to execute arbitrary code on affected OpenSSL installations, potentially leading to full compromise of the affected process. The attack requires user interaction in the form of a request to a malicious server. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

OpenSSL has issued an official update that corrects this vulnerability. Users and administrators should apply the OpenSSL update as soon as possible to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.