{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "1.0.2"
              },
              {
                "fixed": "1.0.2zp"
              },
              {
                "introduced": "1.1.1"
              },
              {
                "fixed": "1.1.1zg"
              },
              {
                "introduced": "3.0.0"
              },
              {
                "fixed": "3.0.20"
              },
              {
                "introduced": "3.3.0"
              },
              {
                "fixed": "3.3.7"
              },
              {
                "introduced": "3.4.0"
              },
              {
                "fixed": "3.4.5"
              },
              {
                "introduced": "3.5.0"
              },
              {
                "fixed": "3.5.6"
              },
              {
                "introduced": "3.6.0"
              },
              {
                "fixed": "3.6.2"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "e818b74be2170fbe957a07b0da4401c2b694b3b8"
            },
            {
              "fixed": "e818b74be2170fbe957a07b0da4401c2b694b3b8"
            },
            {
              "introduced": "e04bd3433fd84e1861bf258ea37928d9845e6a86"
            },
            {
              "fixed": "e04bd3433fd84e1861bf258ea37928d9845e6a86"
            },
            {
              "introduced": "89cd17a031e022211684eb7eb41190cf1910f9fa"
            },
            {
              "fixed": "5aada9c299a3b28fc82348f4e2b93805fa0a0e9c"
            },
            {
              "introduced": "4cb31128b5790819dfeea2739fbde265f71a10a2"
            },
            {
              "fixed": "204165c1550d3aa0f49395af654124cec2bbabf9"
            },
            {
              "introduced": "98acb6b02839c609ef5b837794e08d906d965335"
            },
            {
              "fixed": "03b8620d6e9b7b4d5701865edb6ad86101fe5517"
            },
            {
              "introduced": "636dfadc70ce26f2473870570bfd9ec352806b1d"
            },
            {
              "fixed": "286ddeaac037533bbdce65b3c689e3f7ffebf0f6"
            },
            {
              "introduced": "7b371d80d959ec9ab4139d09d78e83c090de9779"
            },
            {
              "fixed": "fe686e15d84334b284f883118ed92f64b409b3aa"
            },
            {
              "fixed": "01194a8f1941115cd0383bfa91c736dd3993c8bc"
            },
            {
              "fixed": "2e39b7a6993be445fddb9fbce316fa756e0397b6"
            },
            {
              "fixed": "af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
            },
            {
              "fixed": "ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
            },
            {
              "fixed": "fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
            }
          ],
          "repo": "https://github.com/openssl/openssl",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "openssl",
    "cwe_ids": [
      "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28390.json"
  },
  "details": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
  "id": "CVE-2026-28390",
  "modified": "2026-07-27T03:56:13.247846830Z",
  "published": "2026-04-07T22:00:54.172Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28390.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
    },
    {
      "type": "ADVISORY",
      "url": "https://openssl-library.org/news/secadv/20260407.txt"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo"
}