CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.
Other sources
NULL Pointer Dereference in CRMF EncryptedValue Decryption
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u7Fixed in 3.5.6-1~deb13u2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-18 - Upgrade
Upgrade
OpenSSL 3.5to a version that resolves this vulnerability.Fixed in 3.5.7Patch CVE-2026-42767 - Upgrade
Upgrade
OpenSSL 3.6to a version that resolves this vulnerability.Fixed in 3.6.3Patch CVE-2026-42767 - Upgrade
Upgrade
OpenSSL 4.0to a version that resolves this vulnerability.Fixed in 4.0.1Patch CVE-2026-42767 - Compensating control
Do not process untrusted CMP/CRMF messages; ensure CMP clients only communicate with trusted CMP servers to prevent attacker-crafted CertRepMessage EncryptedValue inputs that trigger the NULL pointer dereference (CVE-2026-42767).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42767?
The severity of CVE-2026-42767 is classified as medium with a CVSS score of 5.9.
How do I fix CVE-2026-42767?
To fix CVE-2026-42767, it is recommended to upgrade to the latest version of OpenSSL that addresses this vulnerability.
What type of vulnerability is CVE-2026-42767?
CVE-2026-42767 is a NULL Pointer Dereference vulnerability in the CRMF EncryptedValue decryption process.
Who is affected by CVE-2026-42767?
CVE-2026-42767 affects applications using OpenSSL that implement the Certificate Management Protocol.
What could an attacker do with CVE-2026-42767?
An attacker could exploit CVE-2026-42767 by triggering a NULL pointer dereference in a CMP client application, potentially causing application crashes.