CVE-2026-42765

Deeper analysis

CVE-2026-42765 is a NULL pointer dereference vulnerability in OpenSSL's certificate chain verification code. It occurs when an application enables both partial-chain verification (X509_V_FLAG_PARTIAL_CHAIN) and OCSP response checking for the entire chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL). In this configuration, the verification logic attempts to access the issuer of the final certificate in the chain without a self-signed trusted anchor, resulting in a crash. The issue is present in the core OpenSSL library outside the FIPS module boundary and carries a CVSS score of 7.5.

An unauthenticated remote attacker can trigger the flaw by supplying a certificate chain that lacks a self-signed root during TLS or other certificate-validation operations. Successful exploitation produces a denial of service through process termination; no confidentiality or integrity impact is possible. Both affected verification flags are disabled by default, limiting exposure to applications that have explicitly enabled the combination.

The official OpenSSL advisory and the referenced commits (14340b7 and eb345da) describe the root cause and provide patches that correct the missing NULL check for the issuer pointer when partial-chain mode is active. No other mitigations are specified beyond applying the updates or ensuring the two flags remain disabled.

The current EPSS score of 0.0003 indicates negligible observed exploitation interest.