# CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

CVE-2026-63076 is fixed in 33 products on 1 platform, first by efi-shell-aa64 2024.02-2ubuntu0.10, released August 24, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-63076
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0160
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 24, 2026
- Weakness: NULL Pointer Dereference
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63076

## Description

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.  Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service.  CWE: CWE-476: NULL Pointer Dereference  Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted.  This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable.  FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-aa64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | efi-shell-aa64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-aa64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-aa64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | efi-shell-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | efi-shell-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-x64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | efi-shell-x64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-x64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-x64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [libssl3 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 |
| Linux | libssl3t64 Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [libssl3t64 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3t64-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 |
| Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [libssl3t64 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 |
| Linux | openssl Debian 12.15 (bookworm) | 3.0.22-1~deb12u1 | [DEBIAN-CVE-2026-63076](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63076.md) | Aug 26, 2026 |
| Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-63076](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63076.md) | Aug 26, 2026 |
| Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-63076](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63076.md) | Aug 26, 2026 |
| Linux | openssl RHEL 10 | 3.5.8-1.el10_2 | [RHSA-2026:67154](https://patchblox.com/security/data/fix/linux/rhsa-2026-67154.md) | Sep 14, 2026 |
| Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 |
| Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [openssl 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 |
| Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [openssl 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 |
| Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 |
| Linux | openssl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 |
| Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 |
| Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 |
| Linux | openssl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 |
| Linux | openssl rocky 10 | 1:3.5.8-1.el10_2 | [RLSA-2026:67154](https://patchblox.com/security/data/fix/linux/rlsa-2026-67154.md) | Sep 15, 2026 |
| Linux | openssl rocky 9 | 1:3.5.8-1.el9_8 | [RLSA-2026:67165](https://patchblox.com/security/data/fix/linux/rlsa-2026-67165.md) | Sep 15, 2026 |
| Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 |
| Linux | openssl-3 sles 15.6 | 3.1.4-150600.5.64.1 | [SUSE-SU-2026:3866-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3866-1.md) | Aug 28, 2026 |
| Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 |
| Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 |
| Linux | openssl-3-livepatches sles 15.6 | 0.6-150600.13.19.1 | [SUSE-SU-2026:4038-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4038-1.md) | Sep 7, 2026 |
| Linux | openssl-3-livepatches sles 15.7 | 0.6-150700.16.12.1 | [SUSE-SU-2026:4040-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4040-1.md) | Sep 7, 2026 |
| Linux | openssl-3-livepatches sles 16.0 | 0.6-160000.1.1 | [SUSE-SU-2026:23788-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23788-1.md) | Sep 16, 2026 |
| Linux | openssl-3-x86_64-v3-livepatches sles 16.0 | 0.6-160000.1.1 | [SUSE-SU-2026:23585-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23585-1.md) | Aug 31, 2026 |
| Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 |
| Linux | openssl-devel almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 |
| Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 |
| Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-devel ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 |
| Linux | openssl-devel ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 |
| Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 |
| Linux | openssl-libs almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 |
| Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 |
| Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-libs ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 |
| Linux | openssl-libs ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 |
| Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 |
| Linux | openssl-perl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 |
| Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 |
| Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-perl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 |
| Linux | openssl-perl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 |
| Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl-provider-legacy 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 |
| Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 |
| Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | ovmf Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | ovmf-amdsev Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-amdsev 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-amdsev-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | ovmf-generic Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-generic 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-generic-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | ovmf-inteltdx Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-inteltdx 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-inteltdx-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | ovmf-legacy Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-legacy 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-legacy-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | ovmf-legacy Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-legacy 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-legacy-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-aarch64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | qemu-efi-aarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-aarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-aarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | qemu-efi-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |
| Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 |
| Linux | qemu-efi-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.