CVE-2026-28389
NULL Pointer Dereference in OpenSSL CMS Causes Denial of Service
Publication date: 2026-04-07
Last updated on: 2026-04-23
Assigner: OpenSSL Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openssl | openssl | From 3.0.0 (inc) to 3.0.20 (exc) |
| openssl | openssl | From 3.3.0 (inc) to 3.3.7 (exc) |
| openssl | openssl | From 3.4.0 (inc) to 3.4.5 (exc) |
| openssl | openssl | From 3.5.0 (inc) to 3.5.6 (exc) |
| openssl | openssl | From 3.6.0 (inc) to 3.6.2 (exc) |
| openssl | openssl | From 1.0.2 (inc) to 1.0.2zp (exc) |
| openssl | openssl | From 1.1.1 (inc) to 1.1.1zg (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs during the processing of a crafted CMS EnvelopedData message that uses KeyAgreeRecipientInfo. Specifically, the issue is a NULL pointer dereference caused by examining the optional parameters field of KeyEncryptionAlgorithmIdentifier without verifying its presence. If this field is missing, the application dereferences a NULL pointer.
This flaw affects applications and services that call CMS_decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols.
How can this vulnerability impact me? :
The vulnerability can cause applications processing attacker-controlled CMS data to crash before authentication or cryptographic operations occur. This results in a Denial of Service (DoS) condition.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability causes a denial of service through a NULL pointer dereference when processing crafted CMS EnvelopedData messages. It affects applications that process attacker-controlled CMS data before authentication or cryptographic operations occur.
However, there is no information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.