OpenSSL PKCS7 TypeConfusion CVE-2026-22796 Crash before 3.6
CVE-2026-22796 Published on January 27, 2026
ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
Issue summary: A type confusion vulnerability exists in the signature
verification of signed PKCS#7 data where an ASN1_TYPE union member is
accessed without first validating the type, causing an invalid or NULL
pointer dereference when processing malformed PKCS#7 data.
Impact summary: An application performing signature verification of PKCS#7
data or calling directly the PKCS7_digest_from_attributes() function can be
caused to dereference an invalid or NULL pointer when reading, resulting in
a Denial of Service.
The function PKCS7_digest_from_attributes() accesses the message digest attribute
value without validating its type. When the type is not V_ASN1_OCTET_STRING,
this results in accessing invalid memory through the ASN1_TYPE union, causing
a crash.
Exploiting this vulnerability requires an attacker to provide a malformed
signed PKCS#7 to an application that verifies it. The impact of the
exploit is just a Denial of Service, the PKCS7 API is legacy and applications
should be using the CMS API instead. For these reasons the issue was
assessed as Low severity.
The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module
boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
Vulnerability Analysis
CVE-2026-22796 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
Improper Check for Unusual or Exceptional Conditions
The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
Products Associated with CVE-2026-22796
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-22796 are published in these products:
Affected Versions
OpenSSL:- Version 3.6.0 and below 3.6.1 is affected.
- Version 3.5.0 and below 3.5.5 is affected.
- Version 3.4.0 and below 3.4.4 is affected.
- Version 3.3.0 and below 3.3.6 is affected.
- Version 3.0.0 and below 3.0.19 is affected.
- Version 1.1.1 and below 1.1.1ze is affected.
- Version 1.0.2 and below 1.0.2zn is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.