CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
A malicious CMP server can crash OpenSSL CMP clients via a crafted response, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42767?
CVE-2026-42767 is a medium-severity vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.
Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service.
An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client.
Applications that process untrusted CMP/CRMF messages may be affected.
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Weakness: CWE-476
Which versions are affected by CVE-2026-42767?
It affects 1 product.
Linux distribution packages (4)
openssl-3 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 3.1.4-150600.5.56.1 |
openssl-3 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 3.1.4-150600.5.56.1 |
openssl-3 SUSE:Linux Micro 6.0 | All versions | 3.1.4-15.1 |
openssl-3 SUSE:Linux Micro 6.1 | All versions | 3.1.4-slfo.1.1_11.1 |
Products include Openssl Openssl.
How do I fix CVE-2026-42767?
Apply the vendor's patch.
Is CVE-2026-42767 being exploited?
There is no known exploitation of CVE-2026-42767 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2026-42767, AZL-89787, AZL-89870, AZL-89922, BELL-CVE-2026-42767, CLSA-2026-1782983109 and 10 more.