OpenSSL CMP Format String Bug CVE-2026-63073 Exposes PKI Clients to Crash

On October 22, 2026, Trend Micro's Zero Day Initiative publicly disclosed CVE-2026-63073, a vulnerability in OpenSSL's Certificate Management Protocol (CMP) module. A format string bug allows a remote attacker to cause denial of service on clients that validate server responses using an expected sender or pinned certificate, without requiring authentication. The coordinated disclosure follows roughly six months after the initial vendor report.

The Mechanism: When the Sender DN Becomes a Format String

The defect resides in the ossl_cmp_msg_check_update() function, which handles CMP response validation. When the client receives a server response, it extracts the sender distinguished name (DN) from the message and converts it to a string via X509_NAME_oneline(). This string is then passed directly as a format argument to ERR_raise_data(), OpenSSL's error-reporting routine.

The problem is that percent characters (%) survive the conversion intact. An attacker who controls the sender DN can inject format specifiers such as %s or %n, which reach BIO_vsnprintf() without matching variadic arguments. The result is dereferencing of uncontrolled stack contents, causing a reliable client process crash.

The CVE Record explicitly describes the chain: "Percent characters survive the conversion, so a sender DN such as CN=%s%n reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments." This technical precision distinguishes CVE-2026-63073 from generic information disclosure classifications.

Why ZDI Calls It Disclosure but the CVE Record Denies Controlled Reads

Advisory ZDI-26-789 titles the vulnerability an "Information Disclosure Vulnerability" and states that "this vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL." The CVE Record offers a stricter reading: "The reliable consequence is a denial of service," explicitly noting that "there is no controlled memory write, arbitrary-address read, or reliable path to remote code execution."

This discrepancy reflects a difference in perspective between classification phases. ZDI assesses the informational potential of an uncontrolled format string, where stack dereferencing can non-deterministically expose memory fragments. The CVE Record, more conservative, limits itself to the reliable, reproducible outcome: the CMP client crash, hence denial of service.

The correct technical reading is the CVE Record's: DoS is the documented damage, while information disclosure remains an uncontrollable side effect. This has operational consequences: mitigation priority lies in PKI service continuity, not in protecting specific data.

Attack Conditions: Not All Deployments Are Exposed

The vulnerable path is conditional. Per the CVE Record, "this path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses." CMP clients that do not set these controls — server-to-server configurations or test setups without validation — do not trigger the faulty function.

The lack of required authentication nonetheless amplifies risk for exposed targets. A malicious or intercepted CMP endpoint (man-in-the-middle on provisioning channels) can respond with a crafted sender DN before the client verifies the server's identity. The vulnerability manifests at the moment of preliminary validation, when the client processes the response to extract metadata.

The affected CMP module is explicitly excluded from the FIPS 140-2/140-3 boundary: "No FIPS module is affected, as the CMP implementation is outside the FIPS boundary." This exempts environments with active FIPS validation from urgent review on that front, but does not mitigate operational risk for PKI infrastructures using CMP outside the certified module.

"The specific flaw exists within the handling of Distinguished Names within CMP messages. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier." — ZDI Advisory ZDI-26-789

What to Do Now

• Identify systems using OpenSSL with the CMP module active and expected sender or pinned certificate configuration: these are the only ones exposed per the CVE Record.
• Apply the corrective update released by OpenSSL, verifying the presence of the CVE-2026-63073 fix in the release notes of the installed version.
• Evaluate temporary segmentation of CMP clients from untrusted provisioning endpoints pending patching, if update coordination requires a maintenance window.
• Monitor CMP client process crash logs: an abnormal termination correlated with server responses indicates an exploit attempt or malicious activity on the certificate management infrastructure.

Context: Six Months of Coordination and a Lesson on Legacy Protocols

The timeline reveals standard but not brief coordination: vendor notification on April 8, 2026, public release on October 22, 2026. The roughly six-month period reflects the complexity of patching a foundational library like OpenSSL, where any change to the CMP parser requires extensive regression testing to avoid breaking certificate provisioning in production.

The incident reiterates a recurring lesson in identity management protocols: error and diagnostic metadata are attack surface just as much as operational payloads. The ERR_raise_data() function is designed for internal logging; its use with unvalidated external input turns a debug operation into a compromise vector. Future CMP implementations — and more broadly PKI protocols like EST, SCEP, ACME — should rigorously isolate protocol data from system format strings.

ZDI's choice to classify the vulnerability as information disclosure, despite the CVE Record emphasizing DoS, also raises a metrics question: ZDI's CVSS 6.5 does not fully capture the configurational specificity of the risk. A CMP client without an expected sender is functionally unexposed, making the generic score potentially overestimated for large portions of the installed base. This does not reduce urgency for actual targets, but demands accuracy in internal threat modeling.

Frequently Asked Questions

Is my OpenSSL installation vulnerable if I don't use CMP?

No. The defect is confined to the CMP module and triggers only with specific client validation configurations. The CVE Record excludes impact on other TLS/SSL protocols or applications that do not invoke the CMP APIs.

Why do ZDI and the CVE Record disagree on the primary impact?

ZDI emphasizes the informational potential of an uncontrolled format string; the CVE Record, more conservative, documents only the reproducible DoS. The technical reading privileges the CVE Record for concrete risk assessment.

Does the FIPS module cover this vulnerability?

No, and this is documented by the CVE Record: "No FIPS module is affected, as the CMP implementation is outside the FIPS boundary." FIPS certification does not extend its validation to OpenSSL's CMP code.