CVE-2026-42766

The OpenSSL CMS implementation contains a NULL pointer dereference vulnerability during password-based CMS decryption. The issue occurs because the CMS PasswordRecipientInfo.keyDerivationAlgorithm field is optional in the ASN.1 specification; specifically, OpenSSL fails to check for the field's p...