Executive brief
OpenSSL is a widely used security library that helps applications encrypt data and verify digital signatures. A vulnerability has been identified where a specially crafted encrypted message can cause applications using OpenSSL to crash. This could allow an attacker to disrupt services or cause a denial-of-service (DoS) condition for systems that process password-protected secure messages.
Technical details
A NULL pointer dereference exists in the OpenSSL Cryptographic Message Syntax (CMS) implementation during the decryption of password-encrypted messages. The vulnerability is rooted in the handling of the 'PasswordRecipientInfo.keyDerivationAlgorithm' field, which is defined as OPTIONAL in the ASN.1 specification. If an attacker provides a crafted CMS message where this field is absent, OpenSSL attempts to dereference it without a prior presence check. This flaw can be exploited by a remote attacker sending a malicious message to any application performing password-based CMS decryption, resulting in a process crash (Denial of Service). The FIPS modules are not affected as the vulnerable code resides outside the FIPS boundary.
Affected products
- OpenSSL OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-06-09: advisory: OpenSSL Security Advisory published
- 2026-06-09: disclosed: CVE-2026-42766 published to NVD
References
- https://github.com/openssl/security/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce
- https://github.com/openssl/security/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
- https://github.com/openssl/security/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7
- https://github.com/openssl/security/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4
- https://github.com/openssl/security/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8
- https://openssl-library.org/news/secadv/20260609.txt