7.5

CVE-2026-28389: Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

Modified
AliasesALPINE-CVE-2026-28389UBUNTU-CVE-2026-28389DEBIAN-CVE-2026-28389
Published 07-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-28389 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · -1.63 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 23
MGASA-2026-0091OPENSUSE-SU-2026:10533-1OPENSUSE-SU-2026:20525-1RHSA-2026:7261SUSE-SU-2026:1213-1SUSE-SU-2026:1214-1

Timeline

  1. 07-04-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

Decrease -1.63 pp

From 2.44% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard13 products
  • eco-dotnet-libssl-1.0All versions (No fix recorded)
  • eco-dotnet-libssl-1.0-ld-so-confAll versions (No fix recorded)
  • libcrypto3< 3.6.2-r0
  • libcrypto3-2.34< 3.6.2-r0
  • openssl< 3.6.2-r0
Ubuntu6 products
  • edk2All versions (No fix recorded)
  • edk2-hweAll versions (No fix recorded)
  • nodejsAll versions (No fix recorded)
  • openssl< 1.0.2g-1ubuntu4.20+esm15 | < 1.0.2g-1ubuntu4.fips.4.20.15 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm8 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.8 | < 1.1.1f-1ubuntu2.24+esm3 | < 1.1.1f-1ubuntu2.fips.24.3 | < 3.0.2-0ubuntu1.23 | < 3.0.2-0ubuntu1.23+Fips1 | < 3.0.13-0ubuntu3.9 | < 3.5.3-1ubuntu3.3 | < 3.5.5-1ubuntu3
  • openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.12+Fips1
Wolfi2 products
  • libcrypto3< 3.6.2-r0
  • openssl< 3.6.2-r0
Alpine1 product
  • openssl≥ 1.0.2, < 3.3.7-r0 | ≥ 1.0.2, < 3.5.6-r0
Debian1 product
  • openssl< 3.0.19-1~deb12u2 | < 3.5.5-1~deb13u2 | < 3.6.2-1
Openssl1 product
  • openssl≥ 3.6.0, < 3.6.2 | ≥ 3.5.0, < 3.5.6 | ≥ 3.4.0, < 3.4.5 | ≥ 3.3.0, < 3.3.7 | ≥ 3.0.0, < 3.0.20 | ≥ 1.1.1, < 1.1.1zg | ≥ 1.0.2, < 1.0.2zp

6 vendors · 24 products

References

17 links
Show all 17 references