A critical vulnerability identified in the most recent version of OpenSSL library for x64 systems with AVX512 support could be trivially exploited by threat actors to perform remote memory corruption. OpenSSL is an open-source command line cryptography library used to generate private keys and handle TLS certificates. AVX512 are 512-bit extensions for the x86 instruction set architecture for Intel and AMD CPUs. The exploitation is facilitated by a heap buffer overflow vulnerability that is triggerable in remote contexts like SSL/TLS and was found in four (4) different code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. If successfully exploited, a threat actor could modify a program’s memory, allowing them to access and leak sensitive information and potentially execute arbitrary code remotely. David Benjamin, a Google researcher, published an analysis on Google Git where he found that this vulnerability does not constitute an internal security risk. Rather, it’s a fundamental flaw in the code path which renders version 3.0.4 virtually unusable unless a manual fix or patch is applied. OpenSSL has published a manual fix for this on its GitHub repository, but at this time there is no patch that fixes the bug and developers expect it to be implemented in version 3.0.5. This flaw is being compared to the infamous 2014 Heartbleed vulnerability in OpenSSL which allowed anyone with internet access to read the memory of vulnerable OpenSSL instances to spy on communications, steal sensitive user and services data, and impersonate services and users. The reason that Heartbleed was so catastrophic wasn’t due to the bug itself, but instead stemmed from system administrators being slow to patch their vulnerable systems. CTIX analysts urge all operating system vendors and appliance vendors to notify their users of the vulnerability and manual fix (linked below). Service providers and users should also apply the manual fix and monitor OpenSSL for the 3.0.5 patch as it becomes available for the operating systems, networked appliances, and software that they use.