OpenSSL CVE-2026-31789: Heap Buffer Overflow Risk in 32-bit X.509 Certificate Parsing

A heap buffer overflow vulnerability has been identified in OpenSSL's handling of excessively large OCTET STRING values when converting them to hexadecimal strings, affecting 32-bit platforms. The flaw, tracked as CVE-2026-31789, resides in how buffer size calculations during hex conversion multiply input length by 3—a calculation that can overflow on 32-bit systems, resulting in undersized memory allocation and subsequent buffer overflow.

The vulnerability emerges when parsing crafted X.509 certificates containing OCTET STRING values of extreme size in extensions such as Subject Key Identifier (SKID) or Authority Key Identifier (AKID). During hex conversion, the computed buffer size wraps around due to integer overflow, causing malloc to allocate significantly less memory than required. This allows an attacker to overwrite adjacent heap memory. The practical exploit threshold requires certificates exceeding 1 gigabyte in size, introducing logistical constraints on attack feasibility.

Applications and services that print or log contents of untrusted X.509 certificates face the highest risk, as these operations trigger the vulnerable conversion path. The overflow may lead to application crashes, denial of service, or potentially attacker-controlled code execution depending on heap layout and memory management patterns. System administrators should audit certificate processing workflows, prioritize patching to updated OpenSSL versions, and consider restricting 32-bit deployments in security-sensitive environments until patches are applied.