{"id":"CVE-2026-28389","revision":"d1b7d2b717a6495e9ebd9ac1973152bb","records":[{"revision":"d1b7d2b717a6495e9ebd9ac1973152bb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-28389","aliases":[],"title":"Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","state":0,"publishedAt":"2026-04-07T22:00:53.364+00:00","modifiedAt":"2026-10-15T01:15:34.49+00:00","affected":[{"ecosystem":"Vendor product","name":"OpenSSL","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"OpenSSL\",\n                    \"vendor\": \"OpenSSL\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.6.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.6.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.5.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.5.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.4.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.4.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.3.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.3.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.0.20\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.1.1zg\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.1.1\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"1.0.2zp\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.0.2\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://openssl-library.org/news/secadv/20260407.txt","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28389","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-28389","identifiers":["CVE-2026-28389"]},"retained":false,"historicalAffected":[]}],"coverage":[]}