CVE-2026-31789 is a heap buffer overflow in OpenSSL when converting a huge OCTET STRING to hex on 32 bit platforms. NVD scores it 9.8, but OpenSSL rates it Low. Upgrade to 3.6.2, 3.5.6, 3.4.5, 3.3.7 or 3.0.20.
What's affected
Per the OpenSSL advisory of 7 April 2026, OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable, and only on 32 bit platforms. OpenSSL 1.1.1 and 1.0.2 are not affected. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected, because the code is outside the module boundary.
Fixed versions are 3.6.2, 3.5.6, 3.4.5, 3.3.7 and 3.0.20. OpenSSL 3.1 and 3.2 are out of support and were not analysed, so move off them.
How to check if you're exposed
Print the OpenSSL version and check whether the build is 32 bit:
openssl version
getconf LONG_BIT
file "$(command -v openssl)"
A result of 64 for LONG_BIT means the 32 bit overflow described here does not apply to that process. Then look for applications that print or log the contents of untrusted X.509 certificates, because that is the code path the advisory describes. Embedded devices, older appliances and 32 bit containers are the places to look.
What to do now
- Upgrade OpenSSL to the fixed release for your series: 3.6.2, 3.5.6, 3.4.5, 3.3.7 or 3.0.20.
- Install distribution packages when your OS provides OpenSSL, and check the vendor's security notes for backports.
- Rebuild and redeploy statically linked applications and container images that bundle OpenSSL.
- Do not print or log certificates from untrusted sources on 32 bit systems until patched.
Why it matters
The weakness class is CWE-787, out of bounds write. The buffer needed for the hex text is the input length multiplied by 3. On a 32 bit platform that multiplication can wrap around, so the allocation is smaller than the data copied into it.
The advisory gives a low severity because the certificate would need to be over 1 gigabyte, only 32 bit platforms are affected, and printing or logging such certificates is unlikely. NVD's 9.8 score reflects the worst case of memory corruption. Use your own exposure, not the number alone, to set the urgency. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My servers are 64 bit. Do I have to act?
The advisory says only 32 bit platforms are affected. Update on your normal schedule and check any 32 bit components.
Why do NVD and OpenSSL disagree?
NVD scores the technical worst case. OpenSSL weighs how hard it is to reach, and rates it Low.
Sources
Last reviewed: 19 October 2026.
