OpenSSL Vulnerability: Null Pointer Dereference Leads to DoS

CVE Notify is flagging a critical vulnerability, CVE-2026-28390, lurking within OpenSSL. The issue stems from how the software handles crafted CMS EnvelopedData messages, specifically those employing KeyTransportRecipientInfo. According to CVE Notify, when processing these messages with RSA-OAEP encryption, OpenSSL fails to check for the presence of an optional parameters field. This oversight can lead to a NULL pointer dereference, a classic bug that can bring down an application.

The impact here is pretty straightforward: Denial of Service. Applications that accept and process attacker-controlled CMS data, especially those involved in S/MIME processing or other CMS-based protocols, could be knocked offline before any authentication or crypto even kicks in. This is a nasty one because it hits early in the processing chain, potentially before defenses are even engaged. It’s worth noting that CVE Notify points out that OpenSSL’s FIPS modules versions 3.0 through 3.6 are not affected, as the vulnerable code resides outside that specific module’s boundary.