7.5

CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL

Modified
AliasesALPINE-CVE-2026-28388UBUNTU-CVE-2026-28388DEBIAN-CVE-2026-28388
Published 07-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-28388 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.89%
0%100%
Low · -1.62 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 23
MGASA-2026-0091OPENSUSE-SU-2026:10533-1OPENSUSE-SU-2026:20525-1RHSA-2026:7261SUSE-SU-2026:1213-1SUSE-SU-2026:1214-1

Timeline

  1. 07-04-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.89%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

Decrease -1.62 pp

From 2.50% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard11 products
  • libcrypto3< 3.6.2-r0
  • libcrypto3-2.34< 3.6.2-r0
  • openssl< 3.6.2-r0
  • openssl-3.5< 3.5.6-r0
  • openssl-3.5-libcrypto< 3.5.6-r0
Ubuntu6 products
  • edk2All versions (No fix recorded)
  • edk2-hweAll versions (No fix recorded)
  • nodejsAll versions (No fix recorded)
  • openssl< 1.0.1f-1ubuntu2.27+esm13 | < 1.0.2g-1ubuntu4.20+esm15 | < 1.0.2g-1ubuntu4.fips.4.20.15 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm8 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.8 | < 1.1.1f-1ubuntu2.24+esm3 | < 1.1.1f-1ubuntu2.fips.24.3 | < 3.0.2-0ubuntu1.23 | < 3.0.2-0ubuntu1.23+Fips1 | < 3.0.13-0ubuntu3.9 | < 3.5.3-1ubuntu3.3 | < 3.5.5-1ubuntu3
  • openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.12+Fips1
Wolfi2 products
  • libcrypto3< 3.6.2-r0
  • openssl< 3.6.2-r0
Alpine1 product
  • openssl≥ 1.0.2, < 3.3.7-r0 | ≥ 1.0.2, < 3.5.6-r0
Debian1 product
  • openssl< 3.0.19-1~deb12u2 | < 3.5.5-1~deb13u2 | < 3.6.2-1
Openssl1 product
  • openssl≥ 3.6.0, < 3.6.2 | ≥ 3.5.0, < 3.5.6 | ≥ 3.4.0, < 3.4.5 | ≥ 3.3.0, < 3.3.7 | ≥ 3.0.0, < 3.0.20 | ≥ 1.1.1, < 1.1.1zg | ≥ 1.0.2, < 1.0.2zp

6 vendors · 22 products

References

17 links
Show all 17 references