The vulnerability arises when processing a delta CRL that contains a Delta CRL Indicator extension but lacks the required CRL Number extension. A null pointer dereference may occur during parsing, causing the OpenSSL process to crash. The flaw is classified as CWE‑476 and results in a denial of service; it does not allow code execution or memory disclosure. Based on the description, the crash is triggered when a malformed delta CRL is supplied to an application that performs X.509 verification with the X509_V_FLAG_USE_DELTAS flag enabled.

All OpenSSL releases that support delta CRL verification are affected, regardless of major version, except the FIPS-modified releases 3.0 through 3.6, where the code that executes the vulnerable path lies outside the FIPS module boundary.

The CVSS score of 7.5 indicates a serious potential impact, but the EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, suggesting a low probability of widespread exploitation. The attack requires the attacker to supply a malicious delta CRL to a process that has delta CRL processing enabled, and the victim must have a certificate containing a freshestCRL extension or a base CRL marked with EXFLAG_FRESHEST. Based on the description, this is a targeted scenario rather than a generic remote exploitation vector. Because the flaw results only in a crash, the overall risk is primarily a denial‑of‑service threat rather than a privilege‑exploitation concern.