VulnerabilityModified

CVE-2016-2842

CRITICAL 9.8EPSS 53.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 53.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 53.65% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-119
Affected: openssl/openssl
Source: cve@mitre.org

EPSS trend

EPSS moved from 52.4% on 21 September 2026 to 53.7% on 4 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.