The vulnerability arises from OpenSSL’s CMP implementation incorrectly handling the protectionAlg parameter when verifying password‑based MAC protection. The code fetches the algorithm parameters with X509_ALGOR_get0() and, after confirming the returned pointer is not NULL, blindly treats the data as a PBMParameter without validating the ASN.1 type. An attacker can therefore craft a CMP message containing a differently‑typed parameter and trigger an invalid pointer dereference. The result is an application crash, leading to a denial of service. No memory disclosure or code execution is possible, and the flaw only affects components that enable CMP password‑protected messages.

The affected product is OpenSSL’s cryptographic library, specifically the CMP functionality that processes password‑based protection. Any build of OpenSSL that includes the CMP server or client code and has CMP enabled is at risk. No specific version range is listed, so the issue may apply to multiple releases until patched.

The flaw can be exploited remotely by an unauthenticated attacker who can send a crafted CMP request or response to a vulnerable server or client. The only prerequisite is that the CMP service is reachable and PBM protection is enabled. Because the attack merely causes a crash, the risk level is high for availability but low for confidentiality or integrity. The EPSS score of 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerability catalog. The lack of a code‑execution path limits the overall impact to denial of service, but the ease of triggering the flaw elevates its threat model. Based on the CVSS score of 7.5, the vulnerability is considered high severity.