OpenSSL CMP format-string flaw can leak data without login
Original title: ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
ZDI rates CVE-2026-63073 at CVSS 6.5; remote attackers need no authentication, and no fixed version is named.
ZDI published ZDI-26-789 for an externally controlled format-string flaw in OpenSSL's CMP component. Remote attackers can disclose sensitive information on affected installations without authentication. ZDI assigned CVSS 6.5 and CVE-2026-63073. The snippet gives no affected or fixed versions and does not say the flaw is exploited.
Unconfirmed: Affected and fixed versions are not stated in the snippet.
- ZDI advisory ID is ZDI-26-789.
- Assigned CVE is CVE-2026-63073 with CVSS 6.5.
- Impact is information disclosure, not code execution.
- Authentication is not required.
Impact: remote disclosure of sensitive information
| Product | Affected |
|---|---|
| OpenSSL CMP | — |
- CVEs
- CVE-2026-63073
- Vendors
- OpenSSL
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-63073 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()` | 9.8 | <1% |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.