VulnerabilityModified

CVE-2022-3786

Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer.

HIGH 7.5EPSS 92.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 92.5%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 92.49% probability · 100th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-120
Affected: openssl/openssl · fedoraproject/fedora · nodejs/node.js
Source: openssl-security@openssl.org

EPSS trend

EPSS 92.5% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.