7.5

CVE-2026-28390: Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

Modified
AliasesALPINE-CVE-2026-28390SUSE-SU-2026:1429-1SUSE-SU-2026:1549-1
Published 07-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-28390 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 11
MGASA-2026-0091OPENSUSE-SU-2026:10533-1OPENSUSE-SU-2026:20525-1RHSA-2026:22312RHSA-2026:35869RHSA-2026:36217

Timeline

  1. 07-04-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.80% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse33 products
  • openssl-1_0_0&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.0.2p-150000.3.111.2
  • openssl-1_0_0&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.0.2p-150000.3.111.2
  • openssl-1_0_0&distro=SUSE Linux Enterprise Module for Legacy 15 SP7< 1.0.2p-150000.3.111.2
  • openssl-1_0_0&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 1.0.2p-3.112.1
  • openssl-1_0_0&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 1.0.2p-150000.3.111.2
Redhat16 products
  • compat-openssl10< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-4.el8_6.1 | < 1:1.0.2o-3.el8_4.1
  • compat-openssl10-debuginfo< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-3.el8_4.1
  • compat-openssl10-debugsource< 1:1.0.2o-4.el8_10.2 | < 1:1.0.2o-3.el8_4.1
  • compat-openssl11< 1:1.1.1k-5.el9_8.3
  • compat-openssl11-debuginfo< 1:1.1.1k-5.el9_8.3
Chainguard12 products
  • eco-dotnet-libssl-1.0All versions (No fix recorded)
  • libcrypto3< 3.6.2-r0
  • libcrypto3-2.34< 3.6.2-r0
  • openssl< 3.6.2-r0
  • openssl-3.5< 3.5.6-r0
Ubuntu6 products
  • edk2All versions (No fix recorded)
  • edk2-hweAll versions (No fix recorded)
  • nodejsAll versions (No fix recorded)
  • openssl< 1.0.2g-1ubuntu4.20+esm15 | < 1.0.2g-1ubuntu4.fips.4.20.15 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.23+esm8 | < 1.1.1-1ubuntu2.fips.2.1~18.04.23.8 | < 1.1.1f-1ubuntu2.24+esm3 | < 1.1.1f-1ubuntu2.fips.24.3 | < 3.0.2-0ubuntu1.23 | < 3.0.2-0ubuntu1.23+Fips1 | < 3.0.13-0ubuntu3.9 | < 3.5.3-1ubuntu3.3 | < 3.5.5-1ubuntu3
  • openssl-fipsAll versions (No fix recorded) | < 3.0.13-0ubuntu3.12+Fips1
Wolfi2 products
  • libcrypto3< 3.6.2-r0
  • openssl< 3.6.2-r0
Alpine1 product
  • openssl≥ 1.0.2, < 3.3.7-r0 | ≥ 1.0.2, < 3.5.6-r0
Debian1 product
  • openssl< 3.0.19-1~deb12u2 | < 3.5.5-1~deb13u2 | < 3.6.2-1
Openssl1 product
  • openssl≥ 3.6.0, < 3.6.2 | ≥ 3.5.0, < 3.5.6 | ≥ 3.4.0, < 3.4.5 | ≥ 3.3.0, < 3.3.7 | ≥ 3.0.0, < 3.0.20 | ≥ 1.1.1, < 1.1.1zg | ≥ 1.0.2, < 1.0.2zp

8 vendors · 72 products

References

53 links
Show all 53 references