The CMS_decrypt() and PKCS7_decrypt() functions in OpenSSL can be abused by a Bleichenbacher‑style adaptive‑chosen‑ciphertext attack when an attacker can supply CMS or S/MIME messages and observe error codes or decryption output. The vulnerability allows an attacker to iterate over all KeyTransRecipientInfo entries or over the single RecipientInfo when a certificate is missing, producing a valid PKCS#1 v1.5 padding and effectively decrypting any RSA ciphertext with the victim’s private key or forging a PKCS#1 v1.5 signature. This directly compromises both confidentiality and integrity of encrypted or signed data.

The flaw exists in all OpenSSL releases before the commit series that implements the implicit rejection mechanism for RSA PKCS#1 v1.5 key transport. The advisory does not list specific version ranges; it applies to builds that have not yet incorporated the referenced patches. The FIPS modules (4.0, 3.6, 3.5, 3.4) are not impacted because CMS and S/MIME processing occurs outside the FIPS module boundary.

The CVSS score of 3.7 indicates low severity and the EPSS score of <1% denotes a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted messages and observe error or output differences, which is unlikely for typical deployments where CMS or S/MIME decryption APIs are not exposed to remote input. If an application does expose these APIs, the risk could increase sharply, but the current evidence indicates a low exploitation probability.