PT-2026-47844 · Openssl · Openssl

Igor Ustinov + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-45447

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description A use-after-free condition occurs during PKCS#7 signature verification when processing a specially crafted PKCS#7 or S/MIME signed message. Specifically, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, the PKCS7 verify() function may incorrectly free a caller-owned BIO. A subsequent attempt by the calling application to use or free this BIO via BIO free() can lead to process crashes, heap corruption, or potentially remote code execution. Applications utilizing OpenSSL PKCS#7 APIs are affected, while those using CMS APIs are not. FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-45447

Affected Products

Openssl

References · 9

• https://openssl-library.org/news/secadv/20260609.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45447 · Security Note
• ❌ https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c · Patch, Deleted
• ❌ https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54 · Patch, Deleted
• ❌ https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8 · Patch, Deleted
• ❌ https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e · Patch, Deleted
• ❌ https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c · Patch, Deleted
• https://twitter.com/w4yh/status/2064392982045045081 · Twitter Post
• https://twitter.com/nims213/status/2064391414910185749 · Twitter Post