Answer in brief
CVE-2026-41678 records a High severity (CVSS 8.1) vulnerability in rust-openssl: Incorrect bounds assertion in aes key wrap. The current sources do not mark it as known exploited. The current feed maps rust-openssl/rust-openssl (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rust-openssl/rust-openssl (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rust-openssl/rust-opensslgeneric | >= 0.10.24, < 0.10.78 | Not reported |
Published upstream
Apr 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 17, 2026
rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function. This vulnerability is fixed in 0.10.78.
Quoted source text, attributed separately from HOL analysis.