Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo (OpenSSL OpenSSL)

CVE-2026-28390

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 0.80 % · percentile 57 (2026-10-31)
State: PUBLISHED
Published: 2026-04-07 22:00 UTC
Updated: 2026-10-15 01:15 UTC
Assigner: openssl
NVD status: Modified

Search on…

Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Weaknesses (CWE)

CWE-476 — NULL Pointer Dereference

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

ENISA EUVD · EUVD-2026-19966
GCVE · GCVE-0-2026-28390

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1351 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0914 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
CERTFR-2026-AVI-0888 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0796 — Multiples vulnérabilités dans Tenable Identity Exposure · cert.ssi.gouv.fr
CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0565 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2026-AVI-0550 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0428 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
CERTFR-2026-AVI-0403 — Multiples vulnérabilités dans OpenSSL · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.0.2 < 1.0.2zp
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.1.1 < 1.1.1zg
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.20
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.3.0 < 3.3.7
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.4.0 < 3.4.5
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.5.0 < 3.5.6
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.6.0 < 3.6.2

Affected products

Product	Versions
OpenSSL · OpenSSL	affected 3.6.0 < 3.6.2 ; affected 3.5.0 < 3.5.6 ; affected 3.4.0 < 3.4.5 ; affected 3.3.0 < 3.3.7 ; affected 3.0.0 < 3.0.20 ; affected 1.1.1 < 1.1.1zg

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo (OpenSSL OpenSSL)