Riskcovery

CVE-2026-42766

Possible NULL Dereference in Password-Based CMS Decryption

State
Published
Severity
5.9 Medium
Published
Jun 9, 2026
Updated
Jun 10, 2026
Reserved
Apr 29, 2026

Read the record on cve.org

Description

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.

An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.

Applications that process password-encrypted CMS messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
OpenSSLOpenSSL
  • 4.0.0 to before 4.0.1Affected
  • 3.6.0 to before 3.6.3Affected
  • 3.5.0 to before 3.5.7Affected
  • 3.4.0 to before 3.4.6Affected
  • 3.0.0 to before 3.0.21Affected
  • 1.1.1 to before 1.1.1zhAffected
  • 1.0.2 to before 1.0.2zqAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.