Junglewise Threat Intelligence

CVE-2026-28389: OpenSSL NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-28389 · Severity: high · CVSS 7.5 · Published 2026-04-07

Technologies: Siemens SIMATIC S7-1500 TM MFP, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, OpenSSL, Siemens SIMATIC CN 4100. Vendors: Siemens, OpenSSL.

Executive brief

OpenSSL is a widely used security library that provides encrypted communications for websites and applications. A vulnerability in how it handles certain encrypted messages (CMS EnvelopedData) allows an attacker to crash the application by sending a specially crafted message. This results in a denial-of-service, potentially taking down critical services like secure email (S/MIME) or other encrypted communication channels before they can even verify the sender's identity.

Technical details

A NULL pointer dereference exists in OpenSSL's CMS (Cryptographic Message Syntax) implementation, specifically within the [ec]dh_cms_set_shared_info functions in crypto/cms/cms_dh.c and crypto/cms/cms_ec.c. When processing a CMS EnvelopedData message using KeyAgreeRecipientInfo, the code fails to verify the presence of the optional parameters field in the KeyEncryptionAlgorithmIdentifier before attempting to access it. An unauthenticated remote attacker can exploit this by sending a crafted CMS message that omits this field, causing a SIGSEGV and subsequent denial-of-service. The vulnerability affects applications calling CMS_decrypt() on untrusted input, such as S/MIME mail servers. Patches are available in OpenSSL versions 3.6.2, 3.5.6, 3.4.5, 3.3.7, and 3.0.20.

Affected products

  • OpenSSL OpenSSL 3.6.0 < 3.6.2, 3.5.0 < 3.5.6, 3.4.0 < 3.4.5, 3.3.0 < 3.3.7, 3.0.0 < 3.0.20, 1.1.1 < 1.1.1zg, 1.0.2 < 1.0.2zp
  • Siemens SIMATIC CN 4100 < V5.0
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Timeline

  • 2026-04-06: patched: Fixes committed to OpenSSL repository
  • 2026-04-07: advisory: OpenSSL Security Advisory published

References

Related threats