CVE-2026-42766

Deeper analysis

A NULL pointer dereference vulnerability exists in OpenSSL's CMS implementation during decryption of password-encrypted messages. The issue occurs because the PasswordRecipientInfo.keyDerivationAlgorithm field, defined as OPTIONAL in the ASN.1 specification, may be absent in crafted inputs; the code dereferences this field without checking for its presence. Applications that process password-encrypted CMS messages are affected, while the FIPS modules in OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0 are not impacted as the affected code lies outside the module boundary. The vulnerability carries a CVSS score of 5.9 and is classified under CWE-476.

An attacker can supply a specially crafted password-encrypted CMS message over the network to any application performing password-based CMS decryption. Successful exploitation triggers the NULL dereference, resulting in an application crash and denial of service. The attack requires no privileges or user interaction but has high complexity due to the need for a valid password-encrypted CMS context.

The referenced OpenSSL commits provide the patches that address the missing validation of the keyDerivationAlgorithm field during CMS decryption. Security practitioners should apply the updates from these commits to remediate the issue. The current EPSS score remains low at 0.0007 with no indicated rise.