OpenSSL CMP: unchecked protectionAlg parameter type is dereferenced as a PBMParameter and crashes the process

Impact

When verifying password-based MAC protection on a CMP message, OpenSSL checks only that the protectionAlg parameter pointer is non-NULL, never its ASN.1 type, then casts it and treats it as a PBMParameter. A crafted message supplies a parameter of a different type and the invalid pointer is dereferenced. This happens before any MAC is computed, so the attacker does not need the PBM shared secret. It reaches CMP servers that accept PBM-protected messages via OSSL_CMP_SRV_process_request(), and CMP clients validating responses from a malicious or on-path server. The reliable consequence is a crash - no memory disclosure, no controlled write, no path to code execution. Narrow by construction: CMP is a specialised certificate-enrolment feature an application must explicitly enable, so this matters only if you run internal PKI enrolment infrastructure on OpenSSL's CMP support.

Who can reach it

For servers, any remote unauthenticated party that can send a CMP message to an endpoint accepting PBM-protected messages. For clients, a malicious or on-path CMP server. No shared secret needed either way.

What to do

Upgrade to the fixed OpenSSL release named in the 2026-08-25 advisory and restart your CMP server or client processes - typically a small set of PKI/enrolment hosts, not the whole fleet. If you do not enable CMP anywhere, no action is needed for this CVE beyond your normal OpenSSL update. The record does not name a fixed version for this CVE.

References

Related entries

• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High
• Linux kernel libceph: NULL dereference in CRUSH locality lookup when a parent bucket's type name is missingCVE-2026-68157 · Linux kernel libceph (get_immediate_parent CRUSH type name lookup)High
• Linux kernel (net/tls): A remote peer sends a zero-length TLS 1.3 application_data record - which the RFC explicitlyCVE-2026-72330 · Linux kernel (net/tls)High
• Linux kernel (drivers/nvme/target): A client that completes the TLS handshake against the NVMe-oF TCP target and thenCVE-2026-74385 · Linux kernel (drivers/nvme/target)High
• Linux kernel (drivers/nvme/target): Every connection that dies partway through queue allocation on the NVMe-oF TCPCVE-2026-74386 · Linux kernel (drivers/nvme/target)High