NULL Pointer Dereference in OpenSSL CMS Implementation Affects Password Encrypted Messages

CVE-2026-42766

What is CVE-2026-42766?

A specially crafted password-encrypted CMS message can cause a NULL pointer dereference during decryption in OpenSSL's CMS implementation, resulting in application crashes. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is optional, which may be missing in specially designed inputs. Consequently, during decryption, the absence of this field is not checked, leading to crashes and Denial of Service. Applications capable of processing such messages may be impacted by this vulnerability.

References