CVE-2026-42766

Low

No strong exploitation signal.

CVSS base

5.9 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — probability of exploitation (30 days)

1.1%

63.0th percentile

CISA KEV

Not listed

Weakness / dates

CWE-476

Published 2026-06-09 · modified 2026-07-23

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector	N	Network
Attack Complexity	H	High
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	N	None
Integrity	N	None
Availability	H	High

Timeline

2026-06-09 — Published (NVD)
2026-07-23 — Last modified (NVD)

Description

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Affected

openssl

References

Official: NVD · CVE.org