CVE-2026-28388

/// Technical description

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension

is processed a NULL pointer dereference might happen if the required CRL

Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which

leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509

certificate verification, the delta CRL processing does not check

whether the CRL Number extension is NULL before dereferencing it.

When a malformed delta CRL file is being processed, this parameter

can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in

the verification context, the certificate being verified to contain a

freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and

an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References