A null pointer dereference can occur during delta CRL parsing when a Delta CRL Indicator extension is present but the required CRL Number extension is missing. This leads the OpenSSL code to dereference a null pointer, causing the application to crash and resulting in a denial of service. The flaw is classified as CWE‑476 and, according to the vendor’s security policy, is assessed as low severity even though the CVSS score is 7.5.

The vulnerability affects all OpenSSL versions that support delta CRL verification when the X509_V_FLAG_USE_DELTAS flag is enabled. Any build that processes delta CRLs can be impacted; the FIPS-modified releases (3.0, 3.3, 3.4, 3.5, and 3.6) are explicitly not affected because the code lies outside the FIPS boundary.

The CVSS score of 7.5 suggests a serious impact, but the vendor’s low‑severity classification reflects the limited attack surface. The EPSS score is under 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of wild exploitation. An attacker must have a verification context that enables delta CRL processing, supply a certificate that includes a freshestCRL extension or a base CRL marked with EXFLAG_FRESHEST, and deliver a malformed delta CRL to trigger the crash. No escalation to code execution or memory disclosure is possible, so the risk is primarily a targeted denial of service.