CVE-2026-45447

Name of the Vulnerable Software and Affected Versions OpenSSL version 4.0 OpenSSL version 3.6 OpenSSL version 3.5 OpenSSL version 3.4 OpenSSL version 3.0 OpenSSL version 1.1.1 OpenSSL version 1.0.2

Description A use-after-free condition occurs during PKCS#7 signature verification when processing a specially crafted PKCS#7 or S/MIME signed message. If the SignedData digestAlgorithms field is present as an empty ASN.1 SET, the PKCS7 verify() function may incorrectly free a BIO (Basic Input/Output abstraction) owned by the caller. A subsequent attempt by the application to use or free this BIO via BIO free() leads to memory corruption, process crashes, or potentially remote code execution. This issue affects applications using OpenSSL PKCS#7 APIs, while those using CMS APIs are not affected. FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are not impacted as the affected code resides outside the FIPS module boundary.

Recommendations Update OpenSSL to the latest patched version for versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. As a temporary workaround, avoid using the PKCS7 verify() function to process PKCS#7 or S/MIME signed messages until the update is applied.