--- id: CVE-2026-28390 title: |- Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authen… summary: |- Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authen… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-476 vendor: openssl product: openssl affected: - 'openssl >= 1.0.2, < 1.0.2zp' - 'openssl >= 1.1.1, < 1.1.1zg' - 'openssl >= 3.0.0, < 3.0.20' - 'openssl >= 3.3.0, < 3.3.7' - 'openssl >= 3.4.0, < 3.4.5' - 'openssl >= 3.5.0, < 3.5.6' - 'openssl >= 3.6.0, < 3.6.2' patched: - openssl 3.6.2 published: '2026-04-07' updated: '2026-07-24' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28390' references: - url: >- https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75 label: openssl-security@openssl.org - url: 'https://openssl-library.org/news/secadv/20260407.txt' label: openssl-security@openssl.org - url: 'https://cert-portal.siemens.com/productcert/html/ssa-032379.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28390.json - url: 'https://access.redhat.com/security/cve/CVE-2026-28390' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2456314' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-28390' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28390' - url: 'https://access.redhat.com/errata/RHSA-2026:58563' - url: 'https://access.redhat.com/errata/RHSA-2026:59831' - url: 'https://access.redhat.com/errata/RHSA-2026:71542' - url: 'https://access.redhat.com/errata/RHSA-2026:39297' - url: 'https://access.redhat.com/errata/RHSA-2026:22314' - url: 'https://access.redhat.com/errata/RHSA-2026:22315' - url: 'https://access.redhat.com/errata/RHSA-2026:47096' - url: 'https://access.redhat.com/errata/RHSA-2026:44480' - url: 'https://access.redhat.com/errata/RHSA-2026:36217' - url: 'https://access.redhat.com/errata/RHSA-2026:39012' - url: 'https://access.redhat.com/errata/RHSA-2026:39009' - url: 'https://access.redhat.com/errata/RHSA-2026:35869' - url: 'https://access.redhat.com/errata/RHSA-2026:22313' - url: 'https://access.redhat.com/errata/RHSA-2026:22312' - url: 'https://access.redhat.com/errata/RHSA-2026:38503' - url: 'https://access.redhat.com/errata/RHSA-2026:43513' - url: 'https://access.redhat.com/errata/RHSA-2026:38804' - url: 'https://access.redhat.com/errata/RHSA-2026:38805' - url: 'https://access.redhat.com/errata/RHSA-2026:27998' tags: - nvd - csaf - vex - red-hat epss: 0.00805 epssPercentile: 0.54909 ingestedAt: '2026-07-25T23:05:58.182Z' --- ## Overview Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. ## Affected - `openssl >= 1.0.2, < 1.0.2zp` - `openssl >= 1.1.1, < 1.1.1zg` - `openssl >= 3.0.0, < 3.0.20` - `openssl >= 3.3.0, < 3.3.7` - `openssl >= 3.4.0, < 3.4.5` - `openssl >= 3.5.0, < 3.5.6` - `openssl >= 3.6.0, < 3.6.2` ## Remediation Upgrade past the affected range: - `openssl 3.6.2` ## Vendor advisories - **RHSA-2026:58563** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58563) - **RHSA-2026:59831** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:59831) - **RHSA-2026:71542** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71542) - **RHSA-2026:39297** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:39297) - **RHSA-2026:22314** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22314) - **RHSA-2026:22315** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22315) - **RHSA-2026:47096** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47096) - **RHSA-2026:44480** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44480) - **RHSA-2026:36217** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36217) - **RHSA-2026:39012** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:39012) - **RHSA-2026:39009** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:39009) - **Red Hat VEX** · Moderate · affected: Confidential Cluster Operator, Confidential Compute Attestation, Lightspeed Core, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, Migration Toolkit for Applications 8, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Security 4, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28390.json)