CVE-2026-42766 Details
Description
Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
A NULL pointer dereference vulnerability has been identified in OpenSSL's handling of password-encrypted Cryptographic Message Syntax (CMS) messages. This issue arises during the decryption process, where the CMS PasswordRecipientInfo.keyDerivationAlgorithm field, defined as optional in the ASN.1 specification, may be absent in specially crafted inputs. The OpenSSL CMS implementation dereferences this field without prior validation, leading to a crash and causing a denial-of-service condition. This vulnerability affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, except for the FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0, which are not affected as the issue lies outside the FIPS module boundary.
Users of OpenSSL 4.0 should upgrade to OpenSSL 4.0.1. Users of OpenSSL 3.6 should upgrade to OpenSSL 3.6.3. Users of OpenSSL 3.5 should upgrade to OpenSSL 3.5.7. Users of OpenSSL 3.4 should upgrade to OpenSSL 3.4.6. Users of OpenSSL 3.0 should upgrade to OpenSSL 3.0.21. Users of OpenSSL 1.1.1 should upgrade to OpenSSL 1.1.1zh (premium support customers only). Users of OpenSSL 1.0.2 should upgrade to OpenSSL 1.0.2zq (premium support customers only).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openssl openssl | >= 1.0.2, < 1.0.2zq >= 1.1.1, < 1.1.1zh >= 3.0.0, < 3.0.21 >= 3.4.0, < 3.4.6 >= 3.5.0, < 3.5.7 >= 3.6.0, < 3.6.3 4.0.0 - |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 10, 2026 | CVE Modified | [email protected] |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |