Junglewise Threat Intelligence

CVE-2026-42766: OpenSSL NULL pointer dereference in CMS decryption

CVE-2026-42766 · Severity: info · CVSS 0 · Published 2026-06-09

Technologies: OpenSSL. Vendors: OpenSSL.

Executive brief

OpenSSL is a widely used security library that helps applications encrypt data and verify digital signatures. A vulnerability has been identified where a specially crafted encrypted message can cause applications using OpenSSL to crash. This could allow an attacker to disrupt services or cause a denial-of-service (DoS) condition for systems that process password-protected secure messages.

Technical details

A NULL pointer dereference exists in the OpenSSL Cryptographic Message Syntax (CMS) implementation during the decryption of password-encrypted messages. The vulnerability is rooted in the handling of the 'PasswordRecipientInfo.keyDerivationAlgorithm' field, which is defined as OPTIONAL in the ASN.1 specification. If an attacker provides a crafted CMS message where this field is absent, OpenSSL attempts to dereference it without a prior presence check. This flaw can be exploited by a remote attacker sending a malicious message to any application performing password-based CMS decryption, resulting in a process crash (Denial of Service). The FIPS modules are not affected as the vulnerable code resides outside the FIPS boundary.

Affected products

  • OpenSSL OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2

Timeline

  • 2026-06-09: advisory: OpenSSL Security Advisory published
  • 2026-06-09: disclosed: CVE-2026-42766 published to NVD

References