Junglewise Threat Intelligence

CVE-2026-28390: OpenSSL NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-28390 · Severity: high · CVSS 7.5 · Published 2026-04-07

Technologies: Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, Siemens SIMATIC CN 4100, OpenSSL. Vendors: Siemens, OpenSSL.

Executive brief

OpenSSL is a widely used security library that enables encrypted communications for websites, email, and corporate tools. A vulnerability has been identified where a specially crafted encrypted message can cause applications using OpenSSL to crash. This results in a denial-of-service, potentially disrupting secure communications or crashing services like S/MIME email processing before they can even verify the sender's identity.

Technical details

A NULL pointer dereference exists in OpenSSL's CMS (Cryptographic Message Syntax) implementation, specifically within the rsa_cms_decrypt function in crypto/cms/cms_rsa.c. When processing a CMS EnvelopedData message using KeyTransportRecipientInfo with RSA-OAEP encryption, the code fails to verify the presence of the optional parameters field in the RSA-OAEP SourceFunc algorithm identifier. An unauthenticated remote attacker can exploit this by sending a malformed CMS message, causing the application to crash during the call to CMS_decrypt(). This affects various protocols relying on CMS, such as S/MIME. The issue is resolved in OpenSSL versions 3.6.2, 3.5.6, 3.4.5, 3.3.7, 3.0.20, and 1.1.1zg.

Affected products

  • OpenSSL OpenSSL 3.6.0 to 3.6.1, 3.5.0 to 3.5.5, 3.4.0 to 3.4.4, 3.3.0 to 3.3.6, 3.0.0 to 3.0.19, 1.1.1 to 1.1.1zf
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Timeline

  • 2026-04-06: patched: Fixes committed to OpenSSL repository
  • 2026-04-07: advisory: OpenSSL Security Advisory published
  • 2026-04-07: disclosed: CVE-2026-28390 published

References

Related threats