Use-after-free in OpenSSL - CVE-2026-45447

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU134270

Use-after-free in OpenSSL - CVE-2026-45447

Published: June 10, 2026


Vulnerability identifier: #VU134270
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45447
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the PKCS7_verify() function when processing a specially crafted PKCS#7 or S/MIME signed message during PKCS#7 signature verification. A remote attacker can send a specially crafted signed message to execute arbitrary code.

Applications using the CMS APIs for this processing are not affected.


Affected software

OpenSSL
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
Debian Linux
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
IBM i
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Fedora
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
FreeBSD
Ubuntu
SUSE Linux Enterprise Live Patching
Basesystem Module
Legacy Module
Development Tools Module
openSUSE Leap
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openssl-3-livepatches-debuginfo
openssl-3-livepatches
openssl-3-livepatches-debugsource
openssl-1_1-livepatches
openssl-1_1-livepatches-debugsource
openssl-1_1-livepatches-debuginfo
openssl (Red Hat package)
compat-openssl10 (Red Hat package)
compat-openssl10
libopenssl1_0_0-debuginfo-32bit
libopenssl1_0_0-debuginfo
libopenssl1_0_0
openssl-1_0_0-doc
libopenssl-1_0_0-devel
openssl-1_0_0
openssl-1_0_0-debugsource
openssl-1_0_0-debuginfo
libopenssl1_0_0-hmac
libopenssl-1_0_0-devel-32bit
libopenssl1_0_0-hmac-32bit
libopenssl1_0_0-32bit
libopenssl10
libopenssl10-debuginfo
libopenssl1_1-hmac-32bit
libopenssl1_1-debuginfo
libopenssl1_1
libopenssl-1_1-devel
libopenssl1_1-hmac
openssl-1_1-debugsource
openssl-1_1
openssl-1_1-debuginfo
libopenssl1_1-32bit
libopenssl1_1-debuginfo-32bit
libopenssl-1_1-devel-32bit
openssl-help
openssl-libs
openssl-devel
openssl-debugsource
openssl-debuginfo
openssl
compat-openssl11 (Red Hat package)
openssl-perl
libopenssl-1_1-devel-64bit
libopenssl1_1-hmac-64bit
libopenssl1_1-64bit-debuginfo
libopenssl1_1-64bit
libopenssl1_1-32bit-debuginfo
openssl-1_1-doc
compat-openssl11-devel
compat-openssl11-libs
compat-openssl11-debugsource
compat-openssl11-debuginfo
compat-openssl11
openssl-3-doc
libopenssl-3-devel-64bit
openssl-3-debugsource
openssl-3-debuginfo
libopenssl3
openssl-3
libopenssl-3-devel
libopenssl3-debuginfo
libopenssl3-32bit
libopenssl-3-devel-32bit
libopenssl3-32bit-debuginfo
libopenssl3-64bit-debuginfo
libopenssl3-64bit
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl-3-fips-provider-32bit
libopenssl-3-fips-provider-debuginfo
libopenssl-3-fips-provider
libopenssl-3-fips-provider-64bit
libopenssl-3-fips-provider-64bit-debuginfo
openssl3
shim-aa64
shim-x64
shim-debuginfo
shim-signed
shim-debugsource
shim
shim-unsigned-ia32
shim-unsigned-x64
openssl (Ubuntu package)
openssl (Debian package)
IBM Cloud Pak for Data System
IBM MQ Operator
IBM MQ for HPE NonStop
IBM MQ
IBM Cloud Pak System
OS Image for Red Hat Enterprise Linux
IBM supplied MQ Advanced container images
Operator for PostgreSQL
LANTIME Operating System Firmware (LTOS)
EntireX

How to mitigate CVE-2026-45447

Install security update from vendor's website.

OpenSSL - addressed in versions 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
IBM Cloud Pak for Data System - update to 8.10.26.07.SP3
IBM Cloud Pak System - update to 2.3.6.2
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
OS Image for Red Hat Enterprise Linux - update to 5.0.3.0
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
IBM MQ for HPE NonStop - update to 8.1.0.41
IBM MQ - addressed in versions 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26, 10.0.0.5
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
openssl-3-livepatches-debuginfo - addressed in versions 0.4-150600.13.11.1, 0.4-150700.16.6.1
openssl-3-livepatches - addressed in versions 0.4-150600.13.11.1, 0.4-150700.16.6.1
openssl-3-livepatches-debugsource - addressed in versions 0.4-150600.13.11.1, 0.4-150700.16.6.1
openssl-1_1-livepatches - addressed in versions 0.6-150400.3.20.1, 0.6-150500.6.14.1, 0.6-150600.11.6.1, 0.6-150700.13.6.1
openssl-1_1-livepatches-debugsource - addressed in versions 0.6-150400.3.20.1, 0.6-150500.6.14.1, 0.6-150600.11.6.1, 0.6-150700.13.6.1
openssl-1_1-livepatches-debuginfo - addressed in versions 0.6-150400.3.20.1, 0.6-150500.6.14.1, 0.6-150600.11.6.1, 0.6-150700.13.6.1
openssl (Red Hat package) - addressed in versions 1.0.2k-26.el7_9.2, 3.0.7-18.el9_2.4, 3.0.7-29.el9_4.3, 3.2.2-7.el9_6.4, 3.2.2-16.el10_0.7, 3.5.5-4.el9_8, 3.5.5-4.el10_2
compat-openssl10 (Red Hat package) - addressed in versions 1.0.2o-4.el8_8.1, 1.0.2o-4.el8_10.3
compat-openssl10 - update to 1.0.2o-4.0.2
libopenssl1_0_0-debuginfo-32bit - update to 1.0.2p-3.109.1
libopenssl1_0_0-debuginfo - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
libopenssl1_0_0 - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
openssl-1_0_0-doc - update to 1.0.2p-3.109.1
libopenssl-1_0_0-devel - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
openssl-1_0_0 - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
openssl-1_0_0-debugsource - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
openssl-1_0_0-debuginfo - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
libopenssl1_0_0-hmac - addressed in versions 1.0.2p-3.109.1, 1.0.2p-150000.3.108.1
libopenssl-1_0_0-devel-32bit - update to 1.0.2p-3.109.1
libopenssl1_0_0-hmac-32bit - update to 1.0.2p-3.109.1
libopenssl1_0_0-32bit - update to 1.0.2p-3.109.1
libopenssl10 - update to 1.0.2p-150000.3.108.1
libopenssl10-debuginfo - update to 1.0.2p-150000.3.108.1
libopenssl1_1-hmac-32bit - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2
libopenssl1_1-debuginfo - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
libopenssl1_1 - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
libopenssl-1_1-devel - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
libopenssl1_1-hmac - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2
openssl-1_1-debugsource - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
openssl-1_1 - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
openssl-1_1-debuginfo - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
libopenssl1_1-32bit - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
libopenssl1_1-debuginfo-32bit - update to 1.1.1d-2.131.1
libopenssl-1_1-devel-32bit - addressed in versions 1.1.1d-2.131.1, 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1
openssl-help - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
openssl-libs - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
openssl-devel - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
openssl-debugsource - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
openssl-debuginfo - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
openssl - addressed in versions 1.1.1f-43, 1.1.1wa-17, 3.0.12-52
compat-openssl11 (Red Hat package) - addressed in versions 1.1.1k-4.el9_2.2, 1.1.1k-5.el9_6.3
openssl - update to 1.1.1k-16.0.1
openssl-devel - update to 1.1.1k-16.0.1
openssl-libs - update to 1.1.1k-16.0.1
openssl-perl - update to 1.1.1k-16.0.1
libopenssl-1_1-devel-64bit - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1
libopenssl1_1-hmac-64bit - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2
libopenssl1_1-64bit-debuginfo - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1
libopenssl1_1-64bit - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1
libopenssl1_1-32bit-debuginfo - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1, 1.1.1w-150700.11.22.1
openssl-1_1-doc - addressed in versions 1.1.1l-150400.7.96.2, 1.1.1l-150500.17.57.2, 1.1.1w-150600.5.32.1
compat-openssl11-devel - update to 1.1.1m-19
compat-openssl11-libs - update to 1.1.1m-19
compat-openssl11-debugsource - update to 1.1.1m-19
compat-openssl11-debuginfo - update to 1.1.1m-19
compat-openssl11 - update to 1.1.1m-19
openssl-perl - addressed in versions 1.1.1wa-17, 3.0.12-52
openssl-3-doc - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1
libopenssl-3-devel-64bit - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1
openssl-3-debugsource - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
openssl-3-debuginfo - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl3 - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
openssl-3 - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-devel - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl3-debuginfo - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl3-32bit - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-devel-32bit - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1
libopenssl3-32bit-debuginfo - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl3-64bit-debuginfo - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1
libopenssl3-64bit - addressed in versions 3.0.8-150400.4.87.1, 3.0.8-150500.5.66.1, 3.1.4-150600.5.53.1
libopenssl-3-fips-provider-32bit-debuginfo - addressed in versions 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-fips-provider-32bit - addressed in versions 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-fips-provider-debuginfo - addressed in versions 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-fips-provider - addressed in versions 3.1.4-150600.5.53.1, 3.2.3-150700.5.36.1
libopenssl-3-fips-provider-64bit - update to 3.1.4-150600.5.53.1
libopenssl-3-fips-provider-64bit-debuginfo - update to 3.1.4-150600.5.53.1
openssl3 - update to 3.5.5-5.el8
openssl - update to 3.5.7-1.fc44
shim-aa64 - update to 15.7-4
shim-x64 - update to 15.7-4
shim-debuginfo - update to 15.7-27
shim-signed - update to 15.7-27
shim-debugsource - update to 15.7-27
shim - update to 15.7-27
shim-unsigned-ia32 - update to 15.8-4
shim-unsigned-x64 - update to 15.8-4
EntireX - update to 11.1 Fix6
openssl (Ubuntu package) - addressed in versions 1.0.1f-1ubuntu2.27+esm14, 1.0.2g-1ubuntu4.20+esm16, 1.0.2n-1ubuntu5.13+esm5, 1.1.1-1ubuntu2.1~18.04.23+esm9, 1.1.1f-1ubuntu2.24+esm4, 3.0.2-0ubuntu1.25, 3.0.13-0ubuntu3.11, 3.5.3-1ubuntu3.4, 3.5.5-1ubuntu3.2
openssl (Debian package) - addressed in versions 3.0.20-1~deb12u2, 3.5.6-1~deb13u2

External References

Related Security Bulletins