{"id":"CVE-2026-28390","revision":"80992d59ae9041ceb5df70189cee2276","records":[{"revision":"80992d59ae9041ceb5df70189cee2276","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-28390","aliases":[],"title":"Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","state":0,"publishedAt":"2026-04-07T22:00:54.172+00:00","modifiedAt":"2026-10-15T01:15:35.711+00:00","affected":[{"ecosystem":"Vendor product","name":"OpenSSL","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"OpenSSL\",\n                    \"vendor\": \"OpenSSL\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.6.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.6.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.5.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.5.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.4.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.4.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.3.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.3.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"3.0.20\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.1.1zg\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.1.1\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"1.0.2zp\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.0.2\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://openssl-library.org/news/secadv/20260407.txt","https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28390","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-28390","identifiers":["CVE-2026-28390"]},"retained":false,"historicalAffected":[]}],"coverage":[]}