Openssl: Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup… (CVE-2026-42770)

This vulnerability concerns the Finite Field Cryptography Diffie-Hellman (FFC-DH) peer validation process where the parameter 'q', which should be securely validated, is instead improperly accepted from an attacker. This flaw affects Microsoft products such as Azure Linux and OpenSSL version 3.0. The improper validation could undermine the cryptographic strength of key exchanges relying on FFC-DH, though the severity is assessed as low. No CVSS score is provided, and no known exploits are reported in the wild.

The impact is limited to weakening the validation of cryptographic parameters in FFC-DH key exchanges, which could potentially allow an attacker to influence the key exchange process. However, the vulnerability is classified as low severity, indicating limited risk or difficulty in exploitation. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor Microsoft Security Response Center advisories for updates and apply any official fixes once released.