CVE-2026-42766

Description

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

PUBLISHED Reserved 2026-04-29 | Published 2026-06-09 | Updated 2026-06-10 | Assigner openssl

Problem types

CWE-476 NULL Pointer Dereference

Product status

Credits

Mayank Jangid reporter

Kushal Khemka reporter

Hari Priandana reporter

Bhabani Sankar Das reporter

Qifan Zhang (Palo Alto Networks) reporter

Igor Ustinov remediation developer

References

openssl-library.org/news/secadv/20260609.txt (OpenSSL Advisory) vendor-advisory

github.com/...ommit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4 (4.0.1 git commit) patch

github.com/...ommit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8 (3.6.3 git commit) patch

github.com/...ommit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce (3.5.7 git commit) patch

github.com/...ommit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4 (3.4.6 git commit) patch

github.com/...ommit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7 (3.0.21 git commit) patch

cve.org (CVE-2026-42766)

nvd.nist.gov (CVE-2026-42766)

Download JSON