CVE-2026-42766: OpenSSL CMS NULL Pointer Denial of Service

Technical summary

CVE-2026-42766 is a NULL pointer dereference in OpenSSL's CMS PasswordRecipientInfo implementation. The ASN.1 specification defines the keyDerivationAlgorithm field as OPTIONAL within PasswordRecipientInfo, but the OpenSSL CMS decryption routine dereferences this field without validating its presence first. An attacker crafting a CMS message with an absent keyDerivationAlgorithm can trigger a null pointer dereference during password-based decryption, causing process termination. The vulnerability affects non-FIPS code paths; FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are unaffected because the vulnerable code lies outside the FIPS module boundary.

Business impact

Services relying on password-protected CMS message processing face denial-of-service risk. An unauthenticated attacker can cause application crashes by delivering a malicious CMS message, disrupting availability without requiring special network conditions or user interaction. Organizations in regulated sectors managing encrypted communications via CMS should assess exposure. The CVSS score of 5.9 (MEDIUM severity) reflects high availability impact but no confidentiality or integrity breach.

Affected systems

OpenSSL libraries are affected when used in applications that process password-encrypted CMS messages. The vulnerability is specific to non-FIPS OpenSSL builds. FIPS-validated modules (versions 4.0, 3.6, 3.5, 3.4, and 3.0) are explicitly not affected. Organizations should identify applications using OpenSSL's CMS API with password-based decryption capabilities.

Exploitability

Exploitation requires crafting a valid CMS message structure with an absent keyDerivationAlgorithm field and delivering it to a vulnerable application. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) indicates network accessibility but high attack complexity, meaning the attacker must satisfy specific conditions (correct ASN.1 structure, application actually processing CMS). No public exploit code or KEV status indicates this remains a lower-priority threat compared to easily weaponizable flaws, though proof-of-concept may emerge as awareness spreads.

Remediation

Apply OpenSSL security patches addressing CVE-2026-42766 (verify specific versions against the official OpenSSL advisory). For organizations unable to patch immediately, implement network controls restricting untrusted CMS message ingestion, disable password-based CMS decryption if functionally unnecessary, or isolate affected services. FIPS users are not required to act unless running non-FIPS OpenSSL variants in the same environment.

Patch guidance

Consult the OpenSSL security advisory for CVE-2026-42766 to identify patched versions applicable to your deployment (verify against vendor releases, as patch versions are not specified in this summary). Standard practice involves applying the earliest maintenance release containing the fix within your currently deployed major version branch. Test patches in non-production environments before rolling out broadly, particularly if your organization relies heavily on CMS-based encrypted workflows. Verify that both application code and bundled OpenSSL libraries receive updates.

Detection guidance

Monitor application logs and crash dumps for segmentation faults or access violations occurring during CMS decryption operations. Implement network-level inspection for CMS messages (typically within PKCS#7 or S/MIME structures) with missing or malformed keyDerivationAlgorithm fields. Endpoint Detection and Response (EDR) tools should flag unexpected terminations of services known to process CMS-encrypted data. Organizations using OpenSSL diagnostics can enable debug symbols to correlate crashes to the vulnerable code path; however, remediation via patching remains the primary mitigation.

Why prioritize this

This vulnerability merits medium priority for most organizations. While the CVSS score is 5.9, the high attack complexity and absence of exploitation in the wild (no KEV status) suggest lower immediate risk. However, organizations with CMS-heavy workflows—such as those handling secure email, legacy PKI systems, or cryptographic service providers—should prioritize patching. The flaw is trivial to understand and patch, making swift remediation feasible and cost-effective.

Risk score, explained

CVSS 5.9 (MEDIUM) reflects a denial-of-service impact without confidentiality or integrity consequences. The attack vector is network-based (AV:N), but attack complexity is high (AC:H), meaning the attacker must craft valid CMS structures. Privileges and user interaction are not required (PR:N/UI:N), and the scope is unchanged (S:U). The high availability impact (A:H) drives the score above 5.0. Organizations with mission-critical CMS processing or risk-averse compliance postures may elevate this to 'high' priority locally; others may defer behind critical and high-severity issues.

Frequently asked questions