Cyber Resilience

CVE-2026-42765

Memory Safety in Openssl 3.6.0 – 3.6.3

Published
09 June 2026
Modified
17 June 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0051 41th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2026-42765 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Openssl Openssl. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-42765 is a NULL pointer dereference vulnerability in OpenSSL's certificate chain verification code. It occurs when an application enables both partial-chain verification (X509_V_FLAG_PARTIAL_CHAIN) and OCSP response checking for the entire chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL). In this configuration, the verification logic attempts to access the issuer of the final certificate in the chain without a self-signed trusted anchor, resulting in a crash. The issue is present in the core OpenSSL library outside the FIPS module boundary and carries a CVSS score of 7.5.

An unauthenticated remote attacker can trigger the flaw by supplying a certificate chain that lacks a self-signed root during TLS or other certificate-validation operations. Successful exploitation produces a denial of service through process termination; no confidentiality or integrity impact is possible. Both affected verification flags are disabled by default, limiting exposure to applications that have explicitly enabled the combination.

The official OpenSSL advisory and the referenced commits (14340b7 and eb345da) describe the root cause and provide patches that correct the missing NULL check for the issuer pointer when partial-chain mode is active. No other mitigations are specified beyond applying the updates or ensuring the two flags remain disabled.

The current EPSS score of 0.0003 indicates negligible observed exploitation interest.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A…

more

NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens. This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
T1489 Service Stop Impact
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-28389Same product: Openssl Openssl
CVE-2026-42767Same product: Openssl Openssl
CVE-2026-42764Same product: Openssl Openssl
CVE-2026-28388Same product: Openssl Openssl
CVE-2023-0217Same product: Openssl Openssl
CVE-2025-69421Same product: Openssl Openssl
CVE-2025-15468Same product: Openssl Openssl
CVE-2026-28390Same product: Openssl Openssl
CVE-2024-0727Same product: Openssl Openssl
CVE-2026-42766Same product: Openssl Openssl

Affected Assets

openssl
openssl
4.0.0 · 3.6.0 — 3.6.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation (including static analysis) directly finds null-dereference bugs before deployment.

Documented development standards and tools can enforce null-safety rules and safe pointer usage.

Engineering principles can mandate defensive coding such as explicit null checks before dereference.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect NULL dereference defects before release.

prevents

Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.

prevents

Application security requirements can specify input validation and pointer-safety rules.

prevents

Secure architecture principles encourage defensive design that avoids unsafe pointer use.

prevents

Secure coding standards directly require NULL-pointer checks and safe dereference patterns.

References