Vulnerability-Lookup

MSRC_CVE-2026-28388

Vulnerability from csaf_microsoft - Published: 2026-04-02 00:00 - Updated: 2026-04-15 01:44

Summary

NULL Pointer Dereference When Processing a Delta CRL

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-28388

CWE-476 - NULL Pointer Dereference

None Available There is no fix available for this vulnerability as of now

Vendor Fix 3.3.5-5:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

References

URL

Category

	https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
	https://support.microsoft.com/lifecycle	external
	https://www.first.org/cvss	external
	https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-28388 NULL Pointer Dereference When Processing a Delta CRL - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-28388.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "NULL Pointer Dereference When Processing a Delta CRL",
    "tracking": {
      "current_release_date": "2026-04-15T01:44:38.000Z",
      "generator": {
        "date": "2026-04-15T07:32:45.865Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-28388",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-04-09T01:02:20.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-04-10T14:39:50.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-04-11T01:04:53.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2026-04-14T14:45:17.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Information published."
        },
        {
          "date": "2026-04-15T01:44:38.000Z",
          "legacy_version": "5",
          "number": "5",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 openssl 3.3.5-4",
                "product": {
                  "name": "\u003cazl3 openssl 3.3.5-4",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 openssl 3.3.5-4",
                "product": {
                  "name": "azl3 openssl 3.3.5-4",
                  "product_id": "21168"
                }
              },
              {
                "category": "product_version_range",
                "name": "cbl2 openssl 1.1.1k-39",
                "product": {
                  "name": "cbl2 openssl 1.1.1k-39",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "openssl"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 cloud-hypervisor 32.0-7",
                "product": {
                  "name": "cbl2 cloud-hypervisor 32.0-7",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "cloud-hypervisor"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 cloud-hypervisor-cvm 38.0.72.2-5",
                "product": {
                  "name": "cbl2 cloud-hypervisor-cvm 38.0.72.2-5",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "cloud-hypervisor-cvm"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 edk2 20230301gitf80f052277c8-47",
                "product": {
                  "name": "cbl2 edk2 20230301gitf80f052277c8-47",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "edk2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 hvloader 1.0.1-18",
                "product": {
                  "name": "cbl2 hvloader 1.0.1-18",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "hvloader"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 qemu 6.2.0-27",
                "product": {
                  "name": "cbl2 qemu 6.2.0-27",
                  "product_id": "8"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 qemu 9.1.0-1",
                "product": {
                  "name": "azl3 qemu 9.1.0-1",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "qemu"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 nodejs24 24.13.0-3",
                "product": {
                  "name": "azl3 nodejs24 24.13.0-3",
                  "product_id": "11"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 nodejs24 24.14.1-1",
                "product": {
                  "name": "azl3 nodejs24 24.14.1-1",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs24"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 rust 1.72.0-15",
                "product": {
                  "name": "cbl2 rust 1.72.0-15",
                  "product_id": "10"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 rust 1.75.0-27",
                "product": {
                  "name": "azl3 rust 1.75.0-27",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 rust 1.90.0-6",
                "product": {
                  "name": "azl3 rust 1.90.0-6",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "rust"
          },
          {
            "category": "product_name",
            "name": "azl3 cloud-hypervisor 48.0.246-4",
            "product": {
              "name": "azl3 cloud-hypervisor 48.0.246-4",
              "product_id": "6"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 openssl 3.3.5-4 as a component of Azure Linux 3.0",
          "product_id": "17084-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 openssl 3.3.5-4 as a component of Azure Linux 3.0",
          "product_id": "21168-17084"
        },
        "product_reference": "21168",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cloud-hypervisor 32.0-7 as a component of CBL Mariner 2.0",
          "product_id": "17086-13"
        },
        "product_reference": "13",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cloud-hypervisor-cvm 38.0.72.2-5 as a component of CBL Mariner 2.0",
          "product_id": "17086-14"
        },
        "product_reference": "14",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cloud-hypervisor 48.0.246-4 as a component of Azure Linux 3.0",
          "product_id": "17084-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 edk2 20230301gitf80f052277c8-47 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 hvloader 1.0.1-18 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 openssl 1.1.1k-39 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 qemu 6.2.0-27 as a component of CBL Mariner 2.0",
          "product_id": "17086-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs24 24.13.0-3 as a component of Azure Linux 3.0",
          "product_id": "17084-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 rust 1.72.0-15 as a component of CBL Mariner 2.0",
          "product_id": "17086-10"
        },
        "product_reference": "10",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 qemu 9.1.0-1 as a component of Azure Linux 3.0",
          "product_id": "17084-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.75.0-27 as a component of Azure Linux 3.0",
          "product_id": "17084-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.90.0-6 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs24 24.14.1-1 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-28388",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-6"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "openssl",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21168-17084"
        ],
        "known_affected": [
          "17084-5",
          "17086-13",
          "17086-14",
          "17086-4",
          "17086-3",
          "17086-2",
          "17086-8",
          "17084-11",
          "17086-10",
          "17084-12",
          "17084-9",
          "17084-7",
          "17084-1"
        ],
        "known_not_affected": [
          "17084-6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28388 NULL Pointer Dereference When Processing a Delta CRL - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-28388.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-13"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-14"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-4"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-3"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-2"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-8"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-11"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-10"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-12"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-9"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-7"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-04-09T01:02:20.000Z",
          "details": "3.3.5-5:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-5"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "NULL Pointer Dereference When Processing a Delta CRL"
    }
  ]
}

CVE-2026-28388 (GCVE-0-2026-28388)

Vulnerability from cvelistv5 – Published: 2026-04-07 22:00 – Updated: 2026-04-10 20:18

Title

NULL Pointer Dereference When Processing a Delta CRL

Summary

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity ?

No CVSS data available.

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl

References

URL

Tags

	https://openssl-library.org/news/secadv/20260407.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/602542f…	patch
	https://github.com/openssl/openssl/commit/d3a901e…	patch
	https://github.com/openssl/openssl/commit/a9d187d…	patch
	https://github.com/openssl/openssl/commit/5a0b493…	patch
	https://github.com/openssl/openssl/commit/59c3b31…	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: 3.6.0 , < 3.6.2 (semver) Affected: 3.5.0 , < 3.5.6 (semver) Affected: 3.4.0 , < 3.4.5 (semver) Affected: 3.3.0 , < 3.3.7 (semver) Affected: 3.0.0 , < 3.0.20 (semver) Affected: 1.1.1 , < 1.1.1zg (custom) Affected: 1.0.2 , < 1.0.2zp (custom)

Date Public ?

2026-04-07 14:00

Credits

Igor Morgenstern (Aisle Research) Igor Morgenstern (Aisle Research)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-28388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T20:18:04.195701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T20:18:43.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.6.2",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.6",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.5",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.7",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.20",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zg",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zp",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Igor Morgenstern (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Igor Morgenstern (Aisle Research)"
        }
      ],
      "datePublic": "2026-04-07T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\u003cbr\u003eis processed a NULL pointer dereference might happen if the required CRL\u003cbr\u003eNumber extension is missing.\u003cbr\u003e\u003cbr\u003eImpact summary: A NULL pointer dereference can trigger a crash which\u003cbr\u003eleads to a Denial of Service for an application.\u003cbr\u003e\u003cbr\u003eWhen CRL processing and delta CRL processing is enabled during X.509\u003cbr\u003ecertificate verification, the delta CRL processing does not check\u003cbr\u003ewhether the CRL Number extension is NULL before dereferencing it.\u003cbr\u003eWhen a malformed delta CRL file is being processed, this parameter\u003cbr\u003ecan be NULL, causing a NULL pointer dereference.\u003cbr\u003e\u003cbr\u003eExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\u003cbr\u003ethe verification context, the certificate being verified to contain a\u003cbr\u003efreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\u003cbr\u003ean attacker to provide a malformed CRL to an application that processes it.\u003cbr\u003e\u003cbr\u003eThe vulnerability is limited to Denial of Service and cannot be escalated to\u003cbr\u003eachieve code execution or memory disclosure. For that reason the issue was\u003cbr\u003eassessed as Low severity according to our Security Policy.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\u003cbr\u003eas the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T22:00:52.382Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260407.txt"
        },
        {
          "name": "3.6.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3"
        },
        {
          "name": "3.5.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726"
        },
        {
          "name": "3.4.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8"
        },
        {
          "name": "3.3.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139"
        },
        {
          "name": "3.0.20 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Pointer Dereference When Processing a Delta CRL",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-28388",
    "datePublished": "2026-04-07T22:00:52.382Z",
    "dateReserved": "2026-02-27T13:45:02.161Z",
    "dateUpdated": "2026-04-10T20:18:43.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

MSRC_CVE-2026-28388

CVE-2026-28388 (GCVE-0-2026-28388)

Tags

Sightings

Nomenclature