CVE-2026-34182VulnerabilityPublished 10/22/2026

ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability

Source Zero Day Initiative

Severity

Low

No CVSS score published yet

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 1.1% chance of exploitation in 30 days – higher than 64% of CVEs

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time.

Description

A vulnerability in OpenSSL's CMS AuthEnvelopedData message handling allows network-adjacent attackers who can modify these messages to tamper with their integrity checks. The vulnerability has a low severity rating and requires the attacker to have the ability to alter CMS AuthEnvelopedData messages prior to exploitation.

Summary

CVE-2026-34182 is a vulnerability in OpenSSL affecting the validation of integrity check values in CMS AuthEnvelopedData messages. This flaw permits network-adjacent attackers with the capability to modify such messages to tamper with their integrity checks, potentially undermining message authenticity or integrity. The vulnerability has been assigned a CVSS rating of 3.1 by the Zero Day Initiative, indicating low severity. No affected versions or patch information are provided in the available data.

Impact

An attacker who can modify CMS AuthEnvelopedData messages on affected OpenSSL installations can tamper with the integrity check values, potentially compromising message integrity. However, exploitation requires prior ability to alter these messages, limiting the attack surface. The overall severity is low.

References

zerodayinitiative.com/advisories/ZDI-26-790/ (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:16:11 UTC

References

Related threats