The CMS_decrypt() and PKCS7_decrypt() functions in OpenSSL are susceptible to Bleichenbacher‑style adaptive‑chosen‑ciphertext attacks when an attacker can supply CMS or S/MIME messages and observe error codes or decryption results. The attack logic branches on whether a recipient certificate is provided and iterates over all RecipientInfo entries, allowing an attacker to extract the victim’s private RSA key for decryption or to forge a PKCS#1 v1.5 signature. This vulnerability directly compromises confidentiality and integrity of encrypted or signed messages.

The problem exists in OpenSSL libraries that do not yet implement the implicit rejection mechanism for RSA PKCS#1 v1.5 key transport. No specific version range is supplied in the advisory; it applies to releases lacking the patch shipped in the referenced commits. Systems running earlier OpenSSL builds that still use this key transport method are at risk.

The CVSS score of 3.7 indicates low severity, EPSS is not available, and KEV does not list the vulnerability. This suggests that exploitation density is currently low. However, the attack requires an attacker to supply messages and observe error or output differences, which is unlikely for typical deployments. If an application exposes the CMS or PKCS#7 decryption APIs in a way that a remote attacker can supply data, the risk rises sharply, as the attacker could effectively use the victim’s RSA private key for decryption or signature forgery.