with KeyTransportRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with
RSA-OAEP encryption is processed, the optional parameters field of
RSA-OAEP SourceFunc algorithm identifier is examined without checking
for its presence. This results in a NULL pointer dereference if the field
is missing.
Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenSSL | OpenSSL | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Openssl
Subscribe
|
Openssl
Subscribe
|
| Source | ID | Title |
|---|---|---|
 Debian DSA |
DSA-6201-1 | openssl security update |
 Ubuntu USN |
USN-8155-1 | OpenSSL vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 09 Apr 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Wed, 08 Apr 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openssl
Openssl openssl |
|
| Vendors & Products |
Openssl
Openssl openssl |
Tue, 07 Apr 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. | |
| Title | Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo | |
| Weaknesses | CWE-476 | |
| References |
|
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: openssl
Published:
Updated: 2026-04-07T22:00:54.172Z
Reserved: 2026-02-27T13:45:02.161Z
Link: CVE-2026-28390
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-04-07T22:16:21.190
Modified: 2026-04-08T21:27:00.663
Link: CVE-2026-28390
Redhat
OpenCVE Enrichment
Updated: 2026-04-08T19:45:18Z