Is CVE-2026-42766 actively exploited?

No active exploitation of CVE-2026-42766 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42766 be exploited remotely?

Yes. CVE-2026-42766 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-42766?

CVE-2026-42766 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-42766

MEDIUM

CVE-2026-42766

CWE-476Published: June 9, 2026· Updated: Jun 15, 2026

5.9

CVSS v3.1

Official Description

Issue summary: A specially crafted password-encrypted CMS message

can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash

and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as

OPTIONAL in the ASN.1 specification and may therefore be absent in specially

crafted inputs. During the password-based CMS decryption the OpenSSL

CMS implementation dereferences this field without first checking whether it

was present.

An attacker who supplies such a CMS message to an application performing

password-based CMS decryption can trigger an application crash, leading to

a Denial of Service.

Applications that process password-encrypted CMS messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this

issue, as the affected code is outside the OpenSSL FIPS module boundary.

NVD Source

Technical Analysis

CVE-2026-42766 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.9.