OpenSSL heap buffer overflow in ASN.1 multibyte string conversion

CVE-2026-7383 is a low-severity memory-safety vulnerability in OpenSSL’s ASN.1 multibyte string conversion logic. A signed integer overflow occurs while computing the destination buffer size for Unicode output in ASN1_mbstring_ncopy(), with the same sizing flaw also affecting ASN1_mbstring_copy(). The vulnerable calculation stores the output size in a signed int and can overflow when processing extremely large inputs, including left-shift-based sizing for BMPSTRING and UNIVERSALSTRING output and accumulated per-character byte counts for UTF8STRING output. When the size wraps, the library may allocate an undersized heap buffer and then copy far more data than allocated, resulting in a heap buffer overflow. In the worst case described for UNIVERSALSTRING input near 2^30 characters, the computed size wraps to zero, a minimal allocation is performed, and subsequent copying writes far beyond the allocated buffer. Standard X.509 certificate processing paths in OpenSSL are not expected to reach this condition because the relevant certificate-handling routes exclude the most dangerous string type and impose input-length limits.