Brandon Luo

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** An issue exists in the CMP response validation where the `ossl cmp msg check update()` function converts a peer-supplied sender distinguished name using `X509 NAME oneline()` and passes it directly as the format argument to `ERR raise data()`. Because percent characters are preserved during conversion, a malicious or intercepted CMP endpoint can provide a sender DN containing format specifiers like `%s` or `%n`. These specifiers reach `BIO vsnprintf()` without matching variadic arguments, causing the client to dereference or write through unrelated stack contents. This leads to a denial of service by crashing the CMP client, specifically when the client enforces an expected sender or uses a pinned server certificate. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.