OpenSSL EUVD-2026-65487

Exploitation requires that the target application explicitly enables OpenSSL's CMP subsystem and accepts PBM-protected messages - this is a non-default, application-specific configuration that must be deliberately coded and enabled. On the server side, the vulnerable code path is reached via OSSL_CMP_SRV_process_request() in any application operating as a CMP server that permits PBM message protection. On the client side, exploitation requires either a malicious CMP server or an on-path attacker capable of intercepting and modifying CMP responses in transit. No knowledge of the PBM shared secret is required because the crash occurs during the ASN.1 type-check phase, before the MAC is computed. Standard TLS, certificate validation, OCSP, S/MIME, and all other common OpenSSL consumers are entirely unaffected. FIPS module boundary excludes CMP code, so FIPS-validated deployments face no additional exposure. Limiting factors include the non-default feature prerequisite (CMP must be explicitly enabled by the application developer), impact confined strictly to availability with no confidentiality or integrity consequence, and SSVC-confirmed exploitation status of none.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a network-reachable, zero-authentication DoS with no complexity barrier, and is fully consistent with the vendor description. SSVC rates exploitation as currently none with automatable: yes, meaning scripted mass-exploitation is technically feasible once an exploit is developed, even though no public exploit code has been released at time of analysis. The 'RCE' tag in the source intelligence directly contradicts the vendor advisory, which explicitly states there is no memory disclosure, no controlled memory write, and no code execution path - that tag should be treated as a tagging error and disregarded in risk calculations. EPSS data was not provided in source intelligence, representing a gap in this assessment. Real-world blast radius is substantially narrowed by the requirement that applications must explicitly enable CMP PBM processing: the overwhelming majority of OpenSSL consumers (TLS stacks, certificate validation, OCSP) are entirely unaffected, making this a high-severity finding for a narrow population of PKI infrastructure operators rather than a pervasive threat across all OpenSSL deployments.

An attacker with network access to a CMP server submits a crafted CMP message in which the protectionAlg field carries a non-SEQUENCE ASN.1 type (such as an INTEGER) in place of the expected PBMParameter SEQUENCE. OpenSSL dereferences the mistyped pointer during protection-verification - before computing any MAC and without requiring the PBM shared secret - crashing the CMP-enabled application process. Alternatively, an on-path attacker intercepting CMP client-server communications injects a malformed CMP response to crash the client. No public exploit code has been identified at time of analysis.