CVE-2026-111458
Received Received - Intake

Heap Buffer Overflow in ssldump FAN/1 Fingerprinting

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CIRCL

Description
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111458
EUVD
EUVD-2026-102656

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adulau ssldump 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in the ssldump tool's FAN/1 X.509 certificate fingerprinting function. The function miscalculates the required buffer size for formatting certificate fingerprints, leading to a 3-byte overflow when using sprintf. An attacker can exploit this by providing a crafted pcap file with a TLS X.509 certificate to trigger heap corruption, potentially causing a crash or arbitrary code execution.

Detection Guidance

To detect this vulnerability, check if ssldump is installed and if the vulnerable function is enabled. Run ssldump with FAN/1 fingerprinting options (-j -N) on a test PCAP file containing a TLS X.509 certificate. Monitor for crashes or unexpected behavior indicating heap corruption.

Impact Analysis

If you use ssldump with FAN/1 fingerprinting enabled (e.g., via -j -N options), an attacker could supply a malicious pcap file to crash the program or execute arbitrary code on your system. This requires only the ability to provide input to ssldump, not special privileges.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by enabling denial of service or arbitrary code execution through crafted input. If exploited, it could compromise data integrity or availability, which are critical under these regulations. The heap overflow could lead to unauthorized access or processing of sensitive data, violating GDPR principles or HIPAA security requirements.

Mitigation Strategies

Update ssldump to the latest version from the official repository, which includes the fix replacing sprintf with snprintf in the fanx_fingerprint function. Alternatively, avoid using the -j -N options for FAN/1 fingerprinting until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart