CVE-2026-42766 (GCVE-0-2026-42766)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48
VLAI
Title
Possible NULL Dereference in Password-Based CMS Decryption
Summary
Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 19:46 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
OpenSSL OpenSSL Affected: 4.0.0 , < 4.0.1 (semver)
Affected: 3.6.0 , < 3.6.3 (semver)
Affected: 3.5.0 , < 3.5.7 (semver)
Affected: 3.4.0 , < 3.4.6 (semver)
Affected: 3.0.0 , < 3.0.21 (semver)
Affected: 1.1.1 , < 1.1.1zh (custom)
Affected: 1.0.2 , < 1.0.2zq (custom)
guessed Create a notification for this product.
Date Public
2026-06-09 14:00
Credits
Mayank Jangid Kushal Khemka Hari Priandana Bhabani Sankar Das Qifan Zhang (Palo Alto Networks) Igor Ustinov
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:46:24.673332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:46:27.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zh",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zq",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mayank Jangid"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Kushal Khemka"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hari Priandana"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bhabani Sankar Das"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Qifan Zhang (Palo Alto Networks)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Igor Ustinov"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: A specially crafted password-encrypted CMS message\u003cbr\u003ecan trigger a NULL pointer dereference during CMS decryption.\u003cbr\u003e\u003cbr\u003eImpact summary: This NULL pointer dereference leads to an application crash\u003cbr\u003eand a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\u003cbr\u003eOPTIONAL in the ASN.1 specification and may therefore be absent in specially\u003cbr\u003ecrafted inputs. During the password-based CMS decryption the OpenSSL\u003cbr\u003eCMS implementation dereferences this field without first checking whether it\u003cbr\u003ewas present.\u003cbr\u003e\u003cbr\u003eAn attacker who supplies such a CMS message to an application performing\u003cbr\u003epassword-based CMS decryption can trigger an application crash, leading to\u003cbr\u003ea Denial of Service.\u003cbr\u003e\u003cbr\u003eApplications that process password-encrypted CMS messages may be affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:01.992Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4"
        },
        {
          "name": "3.0.21 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Possible NULL Dereference in Password-Based CMS Decryption",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42766",
    "datePublished": "2026-06-09T16:03:26.679Z",
    "dateReserved": "2026-04-29T09:22:27.968Z",
    "dateUpdated": "2026-06-10T07:48:01.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42766",
      "date": "2026-08-21",
      "epss": "0.0106",
      "percentile": "0.61974"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-23T14:50:12.000Z",
      "cve": "CVE-2026-42766",
      "id": "msrc_CVE-2026-42766",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Possible NULL Dereference in Password-Based CMS Decryption",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-42766.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42766\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2026-06-09T17:17:07.970\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: A specially crafted password-encrypted CMS message\\ncan trigger a NULL pointer dereference during CMS decryption.\\n\\nImpact summary: This NULL pointer dereference leads to an application crash\\nand a Denial of Service.\\n\\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\\ncrafted inputs. During the password-based CMS decryption the OpenSSL\\nCMS implementation dereferences this field without first checking whether it\\nwas present.\\n\\nAn attacker who supplies such a CMS message to an application performing\\npassword-based CMS decryption can trigger an application crash, leading to\\na Denial of Service.\\n\\nApplications that process password-encrypted CMS messages may be affected.\\n\\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\"},{\"lang\":\"es\",\"value\":\"Resumen del problema: Un mensaje CMS cifrado con contrase\u00f1a especialmente dise\u00f1ado puede desencadenar una desreferencia de puntero NULL durante el descifrado CMS.\\n\\nResumen del impacto: Esta desreferencia de puntero NULL conduce a un fallo de la aplicaci\u00f3n y a una denegaci\u00f3n de servicio.\\n\\nEl campo CMS PasswordRecipientInfo.keyDerivationAlgorithm se define como OPCIONAL en la especificaci\u00f3n ASN.1 y, por lo tanto, puede estar ausente en entradas especialmente dise\u00f1adas. Durante el descifrado CMS basado en contrase\u00f1a, la implementaci\u00f3n CMS de OpenSSL desreferencia este campo sin comprobar primero si estaba presente.\\n\\nUn atacante que suministra un mensaje CMS de este tipo a una aplicaci\u00f3n que realiza el descifrado CMS basado en contrase\u00f1a puede desencadenar un fallo de la aplicaci\u00f3n, lo que lleva a una denegaci\u00f3n de servicio.\\n\\nLas aplicaciones que procesan mensajes CMS cifrados con contrase\u00f1a pueden verse afectadas.\\n\\nLos m\u00f3dulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL.\"}],\"affected\":[{\"source\":\"openssl-security@openssl.org\",\"affectedData\":[{\"vendor\":\"OpenSSL\",\"product\":\"OpenSSL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThan\":\"3.6.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.6\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.0.0\",\"lessThan\":\"3.0.21\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.1.1\",\"lessThan\":\"1.1.1zh\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.0.2\",\"lessThan\":\"1.0.2zq\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-09T19:46:24.673332Z\",\"id\":\"CVE-2026-42766\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndExcluding\":\"1.0.2zq\",\"matchCriteriaId\":\"F534B804-67B6-49DA-8A86-0FF21E512908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1\",\"versionEndExcluding\":\"1.1.1zh\",\"matchCriteriaId\":\"43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.21\",\"matchCriteriaId\":\"EDB88756-EDFE-4886-A267-3F19342A6042\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.6\",\"matchCriteriaId\":\"BF7E21E7-AEC0-4882-B1F1-2D056B506F22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.7\",\"matchCriteriaId\":\"6B6B9930-C549-4D88-9784-AF32CCDDB87A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndExcluding\":\"3.6.3\",\"matchCriteriaId\":\"D41B3C45-EC73-4DC8-989D-B2E2792E102F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E881B9A-1A0A-4BC0-8160-20C00561167D\"}]}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://openssl-library.org/news/secadv/20260609.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T12:52:31+00:00",
      "cve": "CVE-2026-42766",
      "id": "CVE-2026-42766",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:fixed": "100",
      "product_status:known_affected": "51",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42766.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T16:31:29Z",
      "cve": "CVE-2026-42766",
      "id": "CVE-2026-42766",
      "initial_release_date": "2026-06-13T02:19:26Z",
      "product_status:known_affected": "503",
      "product_status:known_not_affected": "84",
      "product_status:recommended": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-42766",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-42766.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42766\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-09T19:46:24.673332Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-09T19:46:17.520Z\"}}], \"cna\": {\"title\": \"Possible NULL Dereference in Password-Based CMS Decryption\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Mayank Jangid\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Kushal Khemka\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Hari Priandana\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Bhabani Sankar Das\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Qifan Zhang (Palo Alto Networks)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Igor Ustinov\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Low\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1zh\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.0.2\", \"lessThan\": \"1.0.2zq\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-09T14:00:00.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20260609.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4\", \"name\": \"4.0.1 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8\", \"name\": \"3.6.3 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce\", \"name\": \"3.5.7 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4\", \"name\": \"3.4.6 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7\", \"name\": \"3.0.21 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue summary: A specially crafted password-encrypted CMS message\\ncan trigger a NULL pointer dereference during CMS decryption.\\n\\nImpact summary: This NULL pointer dereference leads to an application crash\\nand a Denial of Service.\\n\\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\\ncrafted inputs. During the password-based CMS decryption the OpenSSL\\nCMS implementation dereferences this field without first checking whether it\\nwas present.\\n\\nAn attacker who supplies such a CMS message to an application performing\\npassword-based CMS decryption can trigger an application crash, leading to\\na Denial of Service.\\n\\nApplications that process password-encrypted CMS messages may be affected.\\n\\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue summary: A specially crafted password-encrypted CMS message\u003cbr\u003ecan trigger a NULL pointer dereference during CMS decryption.\u003cbr\u003e\u003cbr\u003eImpact summary: This NULL pointer dereference leads to an application crash\u003cbr\u003eand a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\u003cbr\u003eOPTIONAL in the ASN.1 specification and may therefore be absent in specially\u003cbr\u003ecrafted inputs. During the password-based CMS decryption the OpenSSL\u003cbr\u003eCMS implementation dereferences this field without first checking whether it\u003cbr\u003ewas present.\u003cbr\u003e\u003cbr\u003eAn attacker who supplies such a CMS message to an application performing\u003cbr\u003epassword-based CMS decryption can trigger an application crash, leading to\u003cbr\u003ea Denial of Service.\u003cbr\u003e\u003cbr\u003eApplications that process password-encrypted CMS messages may be affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2026-06-10T07:48:01.992Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42766\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T07:48:01.992Z\", \"dateReserved\": \"2026-04-29T09:22:27.968Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2026-06-09T16:03:26.679Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.