CVE-2026-42766

Issue summary: A specially crafted password-encrypted CMS message<br /> can trigger a NULL pointer dereference during CMS decryption.<br /> <br /> Impact summary: This NULL pointer dereference leads to an application crash<br /> and a Denial of Service.<br /> <br /> The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as<br /> OPTIONAL in the ASN.1 specification and may therefore be absent in specially<br /> crafted inputs. During the password-based CMS decryption the OpenSSL<br /> CMS implementation dereferences this field without first checking whether it<br /> was present.<br /> <br /> An attacker who supplies such a CMS message to an application performing<br /> password-based CMS decryption can trigger an application crash, leading to<br /> a Denial of Service.<br /> <br /> Applications that process password-encrypted CMS messages may be affected.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this<br /> issue, as the affected code is outside the OpenSSL FIPS module boundary.