This vulnerability, identified as CVE-2026-42768, concerns a Bleichenbacher oracle attack in the Multi-RecipientInfo handling of the CMS_decrypt() and PKCS7_decrypt() functions. The issue potentially allows an attacker to exploit cryptographic message decryption to gain information. The advisory is published by the Microsoft Security Response Center, but no detailed technical or patch information is provided. The affected products include Microsoft and OpenSSL components related to Azure Linux 3.0, though exact affected versions are not specified. No CVSS score or exploit details are available.

The impact involves potential information exposure due to a Bleichenbacher oracle attack on cryptographic message decryption functions. This could allow attackers to gain sensitive information from encrypted messages if exploited. However, no known exploits in the wild have been reported, and the exact impact scope is not detailed in the provided data.

Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Organizations should monitor the vendor advisory for updates and apply patches once available.