CVE-2026-28389: Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMSdecrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Other sources
Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28389?
CVE-2026-28389 has a high severity due to the potential for applications to crash when processing crafted CMS data.
How do I fix CVE-2026-28389?
To fix CVE-2026-28389, update to the patched version of OpenSSL that addresses the NULL dereference issue.
Which products are affected by CVE-2026-28389?
CVE-2026-28389 affects Microsoft azl3 openssl version 3.3.5-4.
What type of vulnerability is CVE-2026-28389?
CVE-2026-28389 is a NULL pointer dereference vulnerability that can lead to application crashes.
What actions should I take if my application processes CMS data related to CVE-2026-28389?
If your application processes CMS data, ensure you apply the available security updates to mitigate the risks associated with CVE-2026-28389.