CVE-2026-28390 — NULL Pointer Dereference in Openssl

CWE-476 — NULL Pointer Dereference90 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 81.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OpensslDebian Openssl
Timeline
PublishedApr 7
Latest updateApr 9

Description

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is ex…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/openssl< openssl 3.0.19-1~deb12u2 (bookworm)
▶CVEListV5openssl/openssl3.6.0 — 3.6.2+6
▶Alpineopenssl/openssl< 3.5.6-r0+1
▶Debianopenssl/openssl< 3.0.19-1~deb12u2+1

🔴Vulnerability Details

4
GHSA
GHSA-fgpp-q3px-3xhc: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen↗2026-04-08
▶
OSV
CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo↗2026-04-07
▶
OSV
CVE-2026-28390: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen↗2026-04-07
▶
OSV
CVE-2026-28390: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen↗2026-04-07
▶

📋Vendor Advisories

4
Ubuntu
OpenSSL vulnerabilities↗2026-04-09
▶
Ubuntu
OpenSSL vulnerabilities↗2026-04-08
▶
Red Hat
openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing↗2026-04-07
▶
Debian
CVE-2026-28390: openssl - Issue summary: During processing of a crafted CMS EnvelopedData message with Key...↗2026
▶

🕵️Threat Intelligence

7
Wiz
CVE-2026-28388 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-28386 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-28387 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-28389 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-28390 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

74
Bugzilla
CVE-2026-28390 shim-unsigned-x64: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-42]↗2026-04-08
▶
Bugzilla
CVE-2026-28390 mozjs128: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-43]↗2026-04-08
▶
Bugzilla
CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-42]↗2026-04-08
▶
Bugzilla
CVE-2026-28390 cosmic-store: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-43]↗2026-04-08
▶
Bugzilla
CVE-2026-28390 bpfman: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [fedora-42]↗2026-04-08
▶