CVE-2026-42768

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to<br /> Bleichenbacher-style attack when an attacker is able to provide the CMS or<br /> S/MIME messages and observe the error code and/or decryption output.<br /> <br /> Impact summary: The Bleichenbacher-style attack allows an attacker to use the<br /> victim&amp;#39;s vulnerable application as a way to decrypt or sign messages with the<br /> victim&amp;#39;s private RSA key.<br /> <br /> The attack is possible in 2 variants.<br /> <br /> 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without<br /> providing the recipient certificate. In this case OpenSSL iterates over every<br /> KeyTransRecipientInfo (KTRI) without stopping at the first success.<br /> <br /> An attacker who authors a message with two KTRI entries — the first one<br /> wrapping a real CEK under the victim&amp;#39;s public key, the second with an<br /> arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to<br /> get a valid PKCS#1 v1.5 padding if the error code of the application is<br /> available.<br /> <br /> That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO &amp;#39;98): an<br /> adaptive-chosen-ciphertext side channel from which the attacker decrypts any<br /> RSA ciphertext to the victim&amp;#39;s key or forges any PKCS#1 v1.5 signature under<br /> it.<br /> <br /> 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with<br /> the recipient certificate, and the recipient is not found, a random<br /> key is substituted.<br /> <br /> An attacker who authors a message and is able to compare both error code and<br /> the result of the decryption, can mount a Bleichenbacher oracle.<br /> <br /> We are not aware of any applications that provide a remote attacker<br /> an opportunity to mount an attack described in these scenarios. We consider<br /> the existence of such application very unlikely, and for this reason this<br /> CVE has been evaluated as Low severity.<br /> <br /> To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the<br /> invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described<br /> in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit<br /> rejection was explicitly disabled.<br /> <br /> The implicit rejection mechanism always returns a plaintext value,<br /> the symmetric key. This result is deterministic for the ciphertext and the<br /> private key. The length of the decryption result can happen to match the<br /> length of the key of the symmetric cipher that was used for the content<br /> encryption. When a certificate is not provided, the last RecipientInfo<br /> producing a key that looks valid will be used. It may cause getting garbage<br /> content on decryption. As a proper way to deal with this a recipient<br /> certificate has to be provided to identify the particular RecipientInfo for<br /> decryption.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as<br /> CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.