InfoSec Signals™
Sign InStart Free
Back to CVE records
High 8.8Published Jun 9, 2026

CVE-2026-45447Heap Use-After-Free in the PKCS7_verify() Function

Updated under an hour ago ()

Does this affect you?

It affects OpenSSL and 16 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS
8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-416, CWE-825
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
openssl
NVD analysis
Modified
Record last updated
Sep 18, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
OpenSSL OpenSSL
openssl:openssl (from the name)
from 4.0.0 before 4.0.1; from 3.6.0 before 3.6.3; from 3.5.0 before 3.5.7; from 3.4.0 before 3.4.6; from 3.0.0 before 3.0.21; from 1.1.1 before 1.1.1zh; from 1.0.2 before 1.0.2zq
CNA record
from 1:3.5.5-4.el10_2 not affected
CISA ADP
from 0:1.0.1e-61.el6_10.1 not affected
CISA ADP
from 1:1.1.1k-16.el8_6 not affected
CISA ADP
from 1:1.0.2o-4.el8_8.1 not affected
CISA ADP
from 1:1.0.2o-4.el8_8.1 not affected
CISA ADP
from 1:1.1.1k-5.el9_6.3 not affected
CISA ADP
from 412.86.202608241157-0 not affected
CISA ADP
Red Hat Cost Management 4
redhat:cost_management
from 1783539156 not affected
CISA ADP
from 1785078604 not affected
CISA ADP
from 1785078581 not affected
CISA ADP
from 1782159791 not affected
CISA ADP
from 1782890503 not affected
CISA ADP
from 1781525684 not affected
CISA ADP
1
CISA ADP
Red Hat Red Hat JBoss Core Services
redhat:jboss_core_services
1
CISA ADP
Red Hat Red Hat JBoss Web Server 6
redhat:jboss_enterprise_web_server
6
CISA ADP
openssl openssl
openssl:openssl
from 1.0.2 before 1.0.2zq; from 1.1.1 before 1.1.1zh; from 3.0.0 before 3.0.21; from 3.4.0 before 3.4.6; from 3.5.0 before 3.5.7; from 3.6.0 before 3.6.3; 4.0.0
NVD

References

  • vendor-advisory
  • patch
  • patch
  • patch
  • patch
  • patch

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.