CVE-2026-28390
NULL Pointer Dereference in OpenSSL CMS Decrypt Causes DoS
Publication date: 2026-04-07
Last updated on: 2026-04-23
Assigner: OpenSSL Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openssl | openssl | From 3.0.0 (inc) to 3.0.20 (exc) |
| openssl | openssl | From 3.3.0 (inc) to 3.3.7 (exc) |
| openssl | openssl | From 3.4.0 (inc) to 3.4.5 (exc) |
| openssl | openssl | From 3.5.0 (inc) to 3.5.6 (exc) |
| openssl | openssl | From 3.6.0 (inc) to 3.6.2 (exc) |
| openssl | openssl | From 1.0.2 (inc) to 1.0.2zp (exc) |
| openssl | openssl | From 1.1.1 (inc) to 1.1.1zg (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs during the processing of a specially crafted CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption. Specifically, the issue arises because the code examines the optional parameters field of the RSA-OAEP SourceFunc algorithm identifier without verifying if this field is present. If the field is missing, this leads to a NULL pointer dereference.
As a result, applications that process attacker-controlled CMS data may crash before any authentication or cryptographic operations take place.
How can this vulnerability impact me? :
The primary impact of this vulnerability is Denial of Service (DoS). Applications and services that call CMS_decrypt() on untrusted input, such as those handling S/MIME processing or CMS-based protocols, may crash when processing maliciously crafted CMS EnvelopedData messages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a denial of service by crashing applications processing attacker-controlled CMS data before authentication or cryptographic operations occur.
However, there is no information provided about its direct impact on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
Applications and services that process untrusted CMS EnvelopedData messages using KeyTransportRecipientInfo with RSA-OAEP encryption are vulnerable to a NULL pointer dereference causing denial of service.
To mitigate this vulnerability, avoid processing untrusted CMS data with affected OpenSSL versions until a patch is applied.
Note that the OpenSSL FIPS modules versions 3.6, 3.5, 3.4, 3.3, and 3.0 are not affected.