Out-of-bounds read in OpenSSL CMS password-based decryption

CVE-2026-9076 is a low-severity heap out-of-bounds read in OpenSSL's CMS password-based decryption path for RFC 3211 / PWRI key unwrap. When processing attacker-supplied CMS data, the PWRI keyEncryptionAlgorithm OID can select a stream-mode KEK cipher even though the unwrap logic in kek_unwrap_key() performs an RFC check-byte validation that assumes sufficient buffer space based on block-cipher semantics. Because the minimum-length guard is derived from the wrapping cipher block length and there is no requirement that the attacker-selected cipher actually be a block cipher, the allocated heap buffer for the unwrapped key may be too small for the 7-byte check-byte read mandated by the RFC. This can cause a small heap over-read during the unwrap attempt. The issue is reachable in applications that call CMS_decrypt() or CMS_decrypt_set1_password(), including equivalent openssl cms -decrypt -pwri_password usage, on untrusted CMS input. The over-read occurs before password authentication succeeds, so no password knowledge is required. The OpenSSL FIPS modules are not affected.