What is the CVSS score of CVE-2026-42766?

CVE-2026-42766 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-42766?

Yes, a patch is available for CVE-2026-42766. Update the affected software to the latest version immediately.

OpenSSL CVE-2026-42766

EUVD-2026-35483 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-09

GHSA-58mv-qqmv-gqgv

Denial Of Service Null Pointer Dereference OpenSSL

5.9

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.3 LOW

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 21:37 vuln.today

Analysis Generated

Jun 09, 2026 - 21:37 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

5.9 (MEDIUM)

CVE Published

Jun 09, 2026 - 11:43 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 11:43 nvd

MEDIUM 5.9

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

AnalysisAI

Null pointer dereference in OpenSSL's password-based CMS decryption path enables remote denial of service against applications that process CMS EnvelopedData with password-based key derivation. The flaw affects a wide range of OpenSSL branches spanning 1.0.2 through 4.0.0, making the exposure surface unusually broad across long-term support and current releases. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS score of 5.9 (Medium) reflects the high attack complexity required to trigger the condition.

Technical ContextAI

CVE-2026-42766 is a CWE-476 (NULL Pointer Dereference) flaw located in OpenSSL's implementation of password-based CMS (Cryptographic Message Syntax, RFC 5652) decryption. CMS is the standard format used for signed, authenticated, and encrypted messages in PKI workflows, S/MIME email, and PKCS#7-based protocols. The password-based decryption variant uses key derivation functions (e.g., PBKDF2, PBES2) rather than asymmetric keys, targeting the EnvelopedData content type. The defect causes a null pointer to be dereferenced during this decryption processing, crashing the calling application. CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the impact is purely availability (process crash), with no confidentiality or integrity compromise. Affected CPE ranges span OpenSSL 1.0.2 < 1.0.2zq, 1.1.1 < 1.1.1zh, 3.0.0 < 3.0.21, 3.4.0 < 3.4.6, 3.5.0 < 3.5.7, 3.6.0 < 3.6.3, and 4.0.0 < 4.0.1 per ENISA EUVD-2026-35483.

RemediationAI

The primary fix is to upgrade to a patched OpenSSL release: 4.0.1 for the 4.0.x branch, 3.6.3 for 3.6.x, 3.5.7 for 3.5.x, 3.4.6 for 3.4.x, 3.0.21 for the 3.0.x LTS branch, 1.1.1zh for extended-support 1.1.1 users, and 1.0.2zq for extended-support 1.0.2 users. Patched versions are confirmed by the OpenSSL 4.0.1 release notes at https://github.com/openssl/openssl/releases/tag/openssl-4.0.1 and the security advisory at https://openssl-library.org/news/secadv/20260609.txt. For systems that cannot be patched immediately, a targeted compensating control is to disable or restrict access to any application endpoint or service that accepts and processes inbound CMS password-based encrypted messages from untrusted network sources; this eliminates the attack surface without affecting asymmetric-key CMS operations. Linux distributions maintaining packaged OpenSSL builds (e.g., Ubuntu via USN-8414-2) should apply OS-level package updates through their standard patching channels to obtain vendor-tested builds.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

CVE-2014-3470 MEDIUM This Month

4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before

CVE-2017-3730 HIGH Act Now POC

7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH Act Now

7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

CVE-2026-42766 vulnerability details – vuln.today

Back

OpenSSL CVE-2026-42766

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in OpenSSL

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code