A nullable field in the CMS password recipient structure allows a crafted encrypted message to cause OpenSSL to dereference a NULL pointer during decryption, leading to an application crash and service interruption. The flaw is located in the function that processes the optional keyDerivationAlgorithm attribute, which is omitted in improperly formed inputs.

The vulnerability affects OpenSSL libraries that include the CMS decryption implementation. Only the FIPS modules (versions 4.0, 3.6, 3.5, 3.4, and 3.0) are exempted, as the affected code lies outside the FIPS boundary. Applications that invoke password‑based CMS decryption using any non‑FIPS build of OpenSSL are susceptible.

EPSS information is not available and the vulnerability is not listed in CISA KEV, indicating no confirmed public exploitation yet. However, an attacker can remotely supply a malformed CMS message to any service that performs password-based decryption, trigger the crash, and cause a denial of service. The CVSS score is 5.9, indicating a medium‑severity denial of service scenario.