CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output.
Other sources
Multi-RecipientInfo Bleichenbacher Oracle in CMSdecrypt() and PKCS7decrypt()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u7Fixed in 3.0.20-1~deb12u1Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-3 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.4.5 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.5.6 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.6.2 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 4.0.1 - Configuration
When using CMS_decrypt() or PKCS7_decrypt() for RSA PKCS#1 v1.5 Key Transport, provide the recipient certificate to identify the specific RecipientInfo for decryption (avoid the case where the last RecipientInfo producing a key that looks valid will be used, or where a random key is substituted).
OpenSSL CMS_decrypt()/PKCS7_decrypt() recipient certificate provided to select RecipientInfo = required - Configuration
Ensure EVP_PKEY_decrypt() uses the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance when RSA PKCS#1 v1.5 Key Transport is in use (previous OpenSSL releases explicitly disabled implicit rejection; this change mitigates the Bleichenbacher oracle branches).
OpenSSL EVP_PKEY_decrypt() RSA PKCS#1 v1.5 implicit rejection mechanism = implicit rejection mechanism enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42768?
The severity of CVE-2026-42768 is rated low with a CVSS score of 3.7.
How do I fix CVE-2026-42768?
To fix CVE-2026-42768, update to the latest version of OpenSSL where the vulnerability has been addressed.
What types of attacks are associated with CVE-2026-42768?
CVE-2026-42768 is associated with Bleichenbacher-style attacks targeting the CMS_decrypt and PKCS7_decrypt functions.
What software is affected by CVE-2026-42768?
CVE-2026-42768 affects OpenSSL and specifically the CMS_decrypt and PKCS7_decrypt functions.
Can CVE-2026-42768 lead to data compromise?
Yes, CVE-2026-42768 can potentially lead to data compromise if attackers can exploit the decryption functions.