Out-of-bounds read in OpenSSL CMS password-based decryption

CVE-2026-9076 is a low-severity heap out-of-bounds read in OpenSSL's CMS password-based decryption path for RFC 3211 / PWRI key unwrap processing. When OpenSSL processes attacker-supplied CMS data, the attacker can choose the KEK cipher via the PWRI keyEncryptionAlgorithm OID. The vulnerable unwrap logic in kek_unwrap_key() performs the RFC-mandated check-byte test by reading 7 bytes from a heap allocation sized from the wrapped-key length in the message. Although a minimum-length guard exists, it is based on the wrapping cipher block length and is ineffective if the attacker selects a stream-mode cipher rather than a block cipher. In that case, the allocated buffer for the unwrapped key may be too small to contain the expected check bytes, leading to a heap buffer over-read during the unwrap attempt. The issue affects applications that call CMS_decrypt() or CMS_decrypt_set1_password(), including equivalent openssl cms -decrypt -pwri_password usage, on untrusted CMS input. The over-read occurs before password authentication succeeds, so no password knowledge is required to trigger it. The OpenSSL FIPS modules are not affected.