CVE-2026-42768
Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
Description
Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.
INFO
Published Date :
June 9, 2026, 5:17 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | LOW | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update OpenSSL to a version with implicit rejection enabled.
- Provide recipient certificate when decrypting messages.
- Ensure CMS and S/MIME processing is outside FIPS module boundary.
Public PoC/Exploit Available at Github
CVE-2026-42768 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-42768.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-42768 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-42768
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Proof of Concepts for OpenSSL vulnerabilities (Findings #2, #3, #4, #5)
C
Tracking CVEs discovered by AI systems — Anthropic, OpenAI, Google Big Sleep, Microsoft MDASH, DepthFirst
Tracking Vulnerabilities That Appear to be Credited to the Anthropic Research Team
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-42768 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-42768 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: OpenSSL, Description: Resumen del problema: Las funciones CMS_decrypt y PKCS7_decrypt son vulnerables a un ataque de estilo Bleichenbacher cuando un atacante es capaz de proporcionar los mensajes CMS o S/MIME y observar el código de error y/o la salida del descifrado. Resumen del impacto: El ataque de estilo Bleichenbacher permite a un atacante usar la aplicación vulnerable de la víctima como una forma de descifrar o firmar mensajes con la clave RSA privada de la víctima. El ataque es posible en 2 variantes. 1. La API de descifrado (CMS_decrypt(), PKCS7_decrypt()) se utiliza sin proporcionar el certificado del destinatario. En este caso, OpenSSL itera sobre cada KeyTransRecipientInfo (KTRI) sin detenerse en el primer éxito. Un atacante que crea un mensaje con dos entradas KTRI - la primera envolviendo una CEK real bajo la clave pública de la víctima, la segunda con un texto cifrado de sondeo arbitrario - obtiene la oportunidad de iterar la segunda KTRI para obtener un relleno PKCS#1 v1.5 válido si el código de error de la aplicación está disponible. Eso es un oráculo de Bleichenbacher (Bleichenbacher, CRYPTO '98): un canal lateral de texto cifrado elegido adaptativo desde el cual el atacante descifra cualquier texto cifrado RSA a la clave de la víctima o falsifica cualquier firma PKCS#1 v1.5 bajo ella. 2. Cuando la API de descifrado (CMS_decrypt(), PKCS7_decrypt()) se proporciona con el certificado del destinatario, y el destinatario no se encuentra, se sustituye una clave aleatoria. Un atacante que crea un mensaje y es capaz de comparar tanto el código de error como el resultado del descifrado, puede montar un oráculo de Bleichenbacher. No tenemos conocimiento de ninguna aplicación que proporcione a un atacante remoto la oportunidad de montar un ataque descrito en estos escenarios. Consideramos muy improbable la existencia de dicha aplicación, y por esta razón este CVE ha sido evaluado como de severidad Baja. Para evitar estos ataques, cuando el transporte de clave RSA PKCS#1 v1.5 está en uso, la función EVP_PKEY_decrypt() invocada utilizará el mecanismo de rechazo implícito descrito en draft-irtf-cfrg-rsa-guidance. En versiones anteriores de OpenSSL, el rechazo implícito estaba explícitamente deshabilitado. El mecanismo de rechazo implícito siempre devuelve un valor de texto plano, la clave simétrica. Este resultado es determinista para el texto cifrado y la clave privada. La longitud del resultado del descifrado puede coincidir con la longitud de la clave del cifrado simétrico que se utilizó para el cifrado del contenido. Cuando no se proporciona un certificado, se utilizará el último RecipientInfo que produzca una clave que parezca válida. Puede causar la obtención de contenido basura en el descifrado. Como una forma adecuada de lidiar con esto, se debe proporcionar un certificado de destinatario para identificar el RecipientInfo particular para el descifrado. Los módulos FIPS en 4.0, 3.6, 3.5 y 3.4 no se ven afectados por este problema, ya que el procesamiento de CMS y S/MIME ocurre fuera del límite del módulo FIPS de OpenSSL. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'OpenSSL', 'product': 'OpenSSL', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.0.1', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.6.0', 'lessThan': '3.6.3', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.5.0', 'lessThan': '3.5.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.4.0', 'lessThan': '3.4.6', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-42768', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-09T19:40:18.647253Z'} -
Initial Analysis by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3 *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:* Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e Types: Patch Added Reference Type OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory -
CVE Modified by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added Reference https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f Added Reference https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d Added Reference https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd Added Reference https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e Removed Reference https://github.com/openssl/security/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f Removed Reference https://github.com/openssl/security/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d Removed Reference https://github.com/openssl/security/commit/dd68364107a58841c0a2546812518b65d3a23abd Removed Reference https://github.com/openssl/security/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 09, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N -
New CVE Received by [email protected]
Jun. 09, 2026
Action Type Old Value New Value Added Description Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary. Added CWE CWE-514 Added Reference https://github.com/openssl/security/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f Added Reference https://github.com/openssl/security/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d Added Reference https://github.com/openssl/security/commit/dd68364107a58841c0a2546812518b65d3a23abd Added Reference https://github.com/openssl/security/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e Added Reference https://openssl-library.org/news/secadv/20260609.txt