Out-of-Bounds Read in OpenSSL CMS Password-Based Decryption

CVE-2026-9076 is a low-severity heap out-of-bounds read in OpenSSL's CMS password-based decryption path, specifically during RFC 3211 / PWRI key unwrap processing in kek_unwrap_key(). When OpenSSL processes attacker-supplied CMS data, the attacker can choose the key-encryption algorithm OID in the PWRI keyEncryptionAlgorithm field such that a stream-mode KEK cipher is used instead of a block cipher. The unwrap logic performs an RFC-mandated check-byte test that reads 7 bytes from a heap allocation sized from the wrapped key length. Although there is a minimum-length guard based on the wrapping cipher's block length, that guard is ineffective when the attacker-selected cipher is not a block cipher. As a result, the allocated buffer holding the unwrapped key may be too small for the check-byte read, causing a heap buffer over-read. The issue is reachable in applications that call CMS_decrypt() or CMS_decrypt_set1_password(), including equivalent openssl cms -decrypt -pwri_password usage, on untrusted CMS input. The over-read occurs during unwrap processing before password authentication succeeds, so attacker knowledge of the password is not required. The OpenSSL FIPS modules are not affected.