CVE-2026-28386 OpenSSL: Out-of-bounds read on x86-64 systems with AVX-512 support when using AES-CFB128 encryption

Impacted Products

• CubeCOS 3.0.0
• CubeCOS 3.1.0
• CubeCMP 2.0

Introduction

This advisory covers CVE-2026-28386

Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. 

Description

This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not written to output. The vulnerable code path is only reached when processing partial blocks (when a previous call left an incomplete block and the current call provides fewer bytes than needed to complete it). Additionally, the input buffer must be positioned at a page boundary with the following page unmapped.

The CFB mode is not used in the TLS/DTLS protocols, which instead use the CBC, GCM, CCM or ChaCha20-Poly1305 modes. Neither CubeCOS nor CubeCMP implements CFB mode, only utilising TLS/DTLS protocols.

For these reasons the issue was assessed as Low severity according to our Security Policy. 

Customer Actions Required

Future updates will include a patched binary that will fully mitigate the issue.

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2026-28386
• https://github.com/openssl/openssl/commit/61f428a2fc6671ede184a19f71e6e495f0689621

Change Log

Contact Us