From 01f4c3e0321d26bde2db5a9ef0e300e08e5886e7 Mon Sep 17 00:00:00 2001 From: Igor Ustinov Date: Thu, 21 May 2026 08:36:54 +0200 Subject: [PATCH] Fix potential NULL dereference processing CMS PasswordRecipientInfo Avoid NULL dereferencing when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo. Fixes CVE-2026-42766 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 18:57:52 2026 (cherry picked from commit f019b72c589071a73acda9812775389a857884c9) --- crypto/cms/cms_pwri.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c index d62dbbde88..96bd235379 100644 --- a/crypto/cms/cms_pwri.c +++ b/crypto/cms/cms_pwri.c @@ -367,6 +367,11 @@ int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms, /* Finish password based key derivation to setup key in "ctx" */ + if (algtmp == NULL) { + ERR_raise_data(ERR_LIB_CMS, CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER, + "Missing KeyDerivationAlgorithm"); + goto err; + } if (!EVP_PBE_CipherInit_ex(algtmp->algorithm, (char *)pwri->pass, (int)pwri->passlen, algtmp->parameter, kekctx, en_de, -- 2.55.0