CVE-2026-28389Published
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-28389 · Microsoft / collected KEV context
cve-program · CVE-2026-28389
- https://openssl-library.org/news/secadv/20260407.txt
- https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686
- https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5
- https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616
- https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a
- https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.