OpenSSL CMS RecipientInfo NULL dereference (CVE-2026-28389)

Summary

A crafted CMS message using key agreement may crash an application.

Vulnerability ID	Vulnerability Overview
CVE-2026-28389	Processing crafted CMS messages that omit mandatory RecipientInfo components leads to an unhandled NULL pointer dereference, causing the parsing application to terminate unexpectedly.

Affected Supported TeraStations

TS71210
Fixed in firmware version 2.06

TS5020 / TS3030
Fixed in firmware version 3.16

 

Back to Security Notices

Date	Description
09/02/2026	Initial release
10/14/2026	Update

Back to Security Notices