Live › vulnerability › CVE-2026-111458
Go to dashboardssldump's fanx_fingerprint function allocates a heap buffer 3 bytes too small for the FAN/1 X.509 fingerprint string, so sprintf overflows it on every call with valid input. An attacker who gets a user to open a crafted pcap file with FAN/1 fingerprinting enabled can crash ssldump or potentially execute code as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running ssldump with FAN/1 fingerprinting enabled (the -j -N options) that process pcap files from untrusted sources are exposed. The overflow is triggered by the certificate data in the capture, so the attacker needs to supply the pcap, not network access to the host. Teams that do not run ssldump, or run it without FAN/1 fingerprinting, can skip it.
No product ranges from the sources yet.
ssldump -V or ssldump -h to read the installed version and compare it with the fixed release listed by the vendor.ssldump with -j -N (FAN/1 fingerprinting).ssldump -j -N on untrusted pcap files.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-111458")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.