Junglewise Threat Intelligence

CVE-2026-22796: OpenSSL type confusion in PKCS#7 signature verification

CVE-2026-22796 · Severity: medium · CVSS 5.3 · Published 2026-01-27

Technologies: OpenSSL. Vendors: OpenSSL.

Executive brief

OpenSSL is a widely used security library that provides encryption and secure communication for websites and applications. A flaw in how it handles certain signed data (PKCS#7) allows an attacker to crash an application by providing a specially crafted file. This results in a denial-of-service, meaning the affected service becomes unavailable to legitimate users.

Technical details

A type confusion vulnerability exists in the PKCS7_digest_from_attributes() function within OpenSSL. The root cause is the lack of type validation for the ASN1_TYPE union member when accessing message digest attributes. If the attribute type is not V_ASN1_OCTET_STRING, the library attempts to access invalid memory, leading to a NULL or invalid pointer dereference. An attacker can exploit this by providing a malformed signed PKCS#7 structure to an application that performs signature verification. This results in a Denial of Service (DoS) via application crash. The vulnerability affects multiple versions including 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1, and 1.0.2.

Affected products

  • OpenSSL OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1, 1.0.2

Timeline

  • 2026-01-27: advisory: OpenSSL Security Advisory published
  • 2026-01-27: disclosed

References

Related threats