CVE-2026-42766

CVE-2026-42766 : OpenSSL’s CMS decryption can dereference an absent PasswordRecipientInfo.keyDerivationAlgorithm field, triggering a NULL pointer dereference, an application crash and Denial of Service. The issue affects password-based CMS decryption paths; the PasswordRecipientInfo field is opti...