October 13, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-28389NVD

Vulnerability Summary

Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
Severity Level
HIGH(7.5)
Published Date
Apr 7, 2026
Last Modified
Jul 24, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.81%Probability
Root Weakness (CWE)
CWE-476: Unknown/Unlisted Weakness ↗
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Openssl Openssl >= 1.0.2 and < 1.0.2zp
  • Openssl Openssl >= 1.1.1 and < 1.1.1zg
  • Openssl Openssl >= 3.0.0 and < 3.0.20
  • Openssl Openssl >= 3.3.0 and < 3.3.7
  • Openssl Openssl >= 3.4.0 and < 3.4.5
  • Openssl Openssl >= 3.5.0 and < 3.5.6
  • Openssl Openssl >= 3.6.0 and < 3.6.2
Patched Versions
  • Openssl Openssl 1.0.2zp
  • Openssl Openssl 1.1.1zg
  • Openssl Openssl 3.0.20
  • Openssl Openssl 3.3.7
  • Openssl Openssl 3.4.5
  • Openssl Openssl 3.5.6
  • Openssl Openssl 3.6.2
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.
🎁7-Day Free Trial — Try Pro or Team, no card required.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
📈EPSS Spike Alerts — Catch rising risk before it peaks.
🎯Custom EPSS/CVSS — Filter noise, focus on risk.
🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.
🐙GitHub Issues — Auto-tracked, no duplicates.
📬Weekly Digest — One clean summary, not inbox spam.
🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).
💬Webhooks — Slack & Teams integration.
🔀Smart Routing — Critical alerts to one channel, rest to another.
🚫Ad-Free — Uninterrupted experience.

External References