CVE-2026-28390 is a vulnerability in OpenSSL's Cryptographic Message Syntax (CMS) EnvelopedData processing. When processing a KeyTransportRecipientInfo with RSA-OAEP encryption, OpenSSL attempts to access an optional parameter field without verifying its presence, leading to a NULL pointer dereference. This causes a denial of service by crashing applications that process attacker-controlled CMS data. The vulnerability is limited to CMS_decrypt() functionality and requires processing of CMS/S/MIME data, which many OpenSSL consumers do not use. Red Hat rates this vulnerability as moderate due to its limited impact and niche affected functionality.

The vulnerability causes a denial of service condition by crashing applications that process specially crafted CMS EnvelopedData messages. There is no evidence of memory corruption or code execution. The impact is limited to applications that use CMS_decrypt() with RSA-OAEP KeyTransportRecipientInfo, which is a niche use case. Confidentiality and integrity are not affected.

Red Hat advises configuring applications that process CMS EnvelopedData messages to accept input only from trusted sources. Additionally, restricting network access to services that process untrusted CMS data can reduce exposure to this denial of service vulnerability. No official patch status is provided in the advisory; check the Red Hat advisory for updates on fixes.