Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Adobe Reader Remote Code Execution Vulnerability
published 7 months ago
Summary
Adobe Reader has a flaw that can allow an attacker to execute malicious code on your computer if you open a specially crafted PDF file. This means that if you open a malicious PDF, the attacker could potentially take control of your computer. Update Adobe Reader to the latest version to fix this issue.
What to do
- Update echo openssl to version 3.0.19-1~deb12u2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | openssl |
< 3.0.19-1~deb12u2 Fix: upgrade to 3.0.19-1~deb12u2
|
Original advisory text
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-control...
Issue summary: During processing of a crafted CMS EnvelopedData message
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may
crash before authentication or cryptographic operations occur resulting in
Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is
processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier
is examined without checking for its presence. This results in a NULL
pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input
(e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the affected code is outside the OpenSSL FIPS module boundary.
References
- https://advisory.echohq.com/cve/CVE-2026-28389 URL
- https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384...
- https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c6...
- https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa80...
- https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be724817...
- https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce6...
- https://openssl-library.org/news/secadv/20260407.txt
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-476NULL Pointer Dereference
Timeline
Published7 Apr 2026
Updated15 Apr 2026
First seen8 Apr 2026
Sources
ECHO-ba3d-b3f7-03e8 · OSV
Track software like this
Free during beta