The update pre-announced as Critical was published and CVE-2022-3602 was adjusted from Critical to High. The same advisory also fixes CVE-2022-3786, a second email address overflow. The OpenSSL blog provides some additional information. Datadog provided a great initial analysis.
This vulnerability is not likely to be exploited in the wild. For exploitation a client or server must be configured to verify a malicious email address within a certificate.
Filippo has got a great post-mortem of this issue. The main question for this vulnerability was definitely, why did it happen in the first place.
Also, hanno asked the question, how the code made it into production. The vulnerability is based on a parser function. As such it would be an ideal candidate for fuzzing. In summary, OpenSSL added new C parser code without doing any basic security testing. A later analysis digs into why the existing OSS-Fuzz fuzzers did not catch it.