Skip to content
Fencer Vulns
high 8.8

CVE-2026-45447 json

Heap Use-After-Free in the PKCS7_verify() Function

published 2026-06-09 5 mo ago modified 2026-09-18 51 d ago also EUVD-2026-35491 , GHSA-f684-cpcq-j565 , JLSEC-2026-1145

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Patch / fix

  • julia AppBundler 1.0.1
  • julia OpenSSL_jll 3.5.7+0
  • OpenSSL OpenSSL 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
  • Red Hat Red Hat Enterprise Linux 10 1:3.5.5-4.el10_2
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.0.1e-61.el6_10.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 1:1.0.2k-26.el7_9.2
  • Red Hat Red Hat Enterprise Linux 8 1:1.0.2o-4.el8_10.3, 1:1.1.1k-16.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 1:1.1.1k-16.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 1:1.0.2o-4.el8_8.1, 1:1.1.1k-16.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 1:1.0.2o-4.el8_8.1, 1:1.1.1k-16.el8_6
  • Red Hat Red Hat Enterprise Linux 9 1:1.1.1k-5.el9_8.4, 1:3.5.5-4.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 1:1.1.1k-4.el9_2.2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 1:1.1.1k-5.el9_4.3
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 1:1.1.1k-5.el9_6.3
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
  • Red Hat Cost Management 4 1783539156
  • Red Hat multicluster engine for Kubernetes 2.8 1785078604
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1785078581
  • Red Hat Red Hat Discovery 2 1782159791, 1782166952
  • Red Hat Red Hat Insights proxy 1.5 1782890503
  • Red Hat Red Hat Update Infrastructure 5 1781525671, 1781525684, 1781525693, 1781525739, 1787135742, 1787241211, 1787241260
  • openssl Debian 12 3.0.20-1~deb12u2
  • openssl Debian 13 3.5.6-1~deb13u2
  • openssl Debian 14 3.6.3-1

debian advisories DEBIAN-CVE-2026-45447

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.25
  • openssl Ubuntu 24.04 LTS 3.0.13-0ubuntu3.11
  • openssl Ubuntu 25.10 3.5.3-1ubuntu3.4
  • openssl Ubuntu 26.04 LTS 3.5.5-1ubuntu3.2
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm14
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm16
  • openssl Ubuntu Pro 18.04 LTS 1.1.1-1ubuntu2.1~18.04.23+esm9
  • openssl Ubuntu Pro FIPS-updates 18.04 LTS 1.1.1-1ubuntu2.fips.2.1~18.04.23.9

ubuntu advisories UBUNTU-CVE-2026-45447

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bootupd hummingbird 1 0.3.2-1.hum1
  • rust-bootupd hummingbird 1 0.3.2-1.hum1
  • ruby3.4 hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-libs hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-bundled-gems hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-default-gems hummingbird 1 3.4.10-31.7.hum1
  • ruby4.0 hummingbird 1 4.0.6-37.3.hum1
  • ruby4.0-libs hummingbird 1 4.0.6-37.3.hum1

red hat advisories RHSA-2026:84573RHSA-2026:84572RHSA-2026:83617RHSA-2026:71542RHSA-2026:67551RHSA-2026:62790

  • openssl-3 SLE Module for Basesystem 15 SP7 3.2.3-150700.5.36.1
  • openssl-1_1 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 1.1.1l-150400.7.96.2
  • openssl-3 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 3.0.8-150400.4.87.1
  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.8.1
  • openssl-1_1 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 1.1.1l-150500.17.57.2
  • openssl-1_0_0 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 1.0.2p-150000.3.108.1
  • openssl-3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 3.0.8-150500.5.66.1
  • openssl-1_1 SLE Module for Legacy 15 SP7, SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 1.1.1w-150700.11.22.1

suse advisories SUSE-SU-2026:2662-1SUSE-SU-2026:2648-1SUSE-SU-2026:2621-1SUSE-SU-2026:2614-1SUSE-SU-2026:2598-1SUSE-SU-2026:22251-1

  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.8.1
  • openssl-3 openSUSE Tumbleweed 3.5.3-6.1

opensuse advisories openSUSE-SU-2026:21005-1openSUSE-SU-2026:11023-1

  • compat-openssl11 AlmaLinux 9 1:1.1.1k-5.el9_8.4
  • compat-openssl10 AlmaLinux 8 1:1.0.2o-4.el8_10.3
  • openssl AlmaLinux 8 1:1.1.1k-16.el8_6
  • openssl-libs AlmaLinux 8 1:1.1.1k-16.el8_6
  • openssl-perl AlmaLinux 8 1:1.1.1k-16.el8_6
  • openssl AlmaLinux 10 1:3.5.5-4.el10_2.alma.1
  • openssl-libs AlmaLinux 10 1:3.5.5-4.el10_2.alma.1
  • openssl-perl AlmaLinux 10 1:3.5.5-4.el10_2.alma.1

almalinux advisories ALSA-2026:44438ALSA-2026:36215ALSA-2026:26275ALSA-2026:25237ALSA-2026:25239

  • compat-openssl11 Rocky Linux 9 1:1.1.1k-5.el9_8.4
  • compat-openssl10 Rocky Linux 8 1:1.0.2o-4.el8_10.3
  • openssl Rocky Linux 8 1:1.1.1k-16.el8_10
  • openssl Rocky Linux 10 1:3.5.5-4.el10_2
  • openssl Rocky Linux 9 1:3.5.5-4.el9_8

rocky linux advisories RLSA-2026:44438RLSA-2026:36215RLSA-2026:26275RLSA-2026:25237RLSA-2026:25239

  • openssl Alpine 3.21 3.3.7-r1
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 3.5.7-r0

alpine advisories ALPINE-CVE-2026-45447

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 Azure Linux 3.0 20240524git3e722403cd16-18
  • openssl Azure Linux 3.0 3.3.7-4

azure linux advisories AZL-89864AZL-92837

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45447 updated cvss 8.1

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/hypershift-rhel9-operator
    affected: workaround, no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-trust-manager-rhel9 1790598593
    fixed: vendor fix RHSA-2026:72502
  • Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1783539156
    fixed: vendor fix RHSA-2026:39981
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/console-mce-rhel9 1785078604
    fixed: vendor fix RHSA-2026:47735
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1785078581
    fixed: vendor fix RHSA-2026:47737
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1782166952, discovery/discovery-server-rhel9 1782159791
    fixed: vendor fix RHSA-2026:29197
show 31 more
  • Red Hat Enterprise Linux AppStream (v. 8) compat-openssl10 1.0.2o-4.el8_10.3
    fixed: vendor fix RHSA-2026:36215
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.5.5-4.el9_8, compat-openssl11 1.1.1k-5.el9_8.4
    fixed: vendor fix RHSA-2026:44438
  • Red Hat Enterprise Linux AppStream (v. 10) openssl-perl 3.5.5-4.el10_2
    fixed: vendor fix RHSA-2026:25237
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) compat-openssl10 1.0.2o-4.el8_8.1
    fixed: vendor fix RHSA-2026:36217
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) compat-openssl11 1.1.1k-4.el9_2.2
    fixed: vendor fix RHSA-2026:39012
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) compat-openssl11 1.1.1k-5.el9_4.3
    fixed: vendor fix RHSA-2026:39009
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) openssl-perl 3.2.2-16.el10_0.7
    fixed: vendor fix RHSA-2026:71542
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) openssl-perl 3.2.2-7.el9_6.4, compat-openssl11 1.1.1k-5.el9_6.3
    fixed: vendor fix RHSA-2026:35869
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) compat-openssl10 1.0.2o-4.el8_8.1
    fixed: vendor fix RHSA-2026:36217
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-16.el8_6, openssl-libs 1.1.1k-16.el8_6, openssl-perl 1.1.1k-16.el8_6
    fixed: vendor fix RHSA-2026:26275
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.5.5-4.el9_8, openssl-libs 3.5.5-4.el9_8
    fixed: vendor fix RHSA-2026:25239
  • Red Hat Enterprise Linux BaseOS (v. 10) openssl 3.5.5-4.el10_2, openssl-libs 3.5.5-4.el10_2
    fixed: vendor fix RHSA-2026:25237
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) openssl 1.1.1k-16.el8_6, openssl-libs 1.1.1k-16.el8_6, openssl-perl 1.1.1k-16.el8_6
    fixed: vendor fix RHSA-2026:26275
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssl 3.0.7-18.el9_2.4, openssl-libs 3.0.7-18.el9_2.4
    fixed: vendor fix RHSA-2026:84572
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) openssl 3.0.7-29.el9_4.3, openssl-libs 3.0.7-29.el9_4.3
    fixed: vendor fix RHSA-2026:84573
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssl 3.2.2-16.el10_0.7, openssl-libs 3.2.2-16.el10_0.7
    fixed: vendor fix RHSA-2026:71542
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) openssl 3.2.2-7.el9_6.4, openssl-libs 3.2.2-7.el9_6.4
    fixed: vendor fix RHSA-2026:83617
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) openssl 1.1.1k-16.el8_6, openssl-libs 1.1.1k-16.el8_6, openssl-perl 1.1.1k-16.el8_6 Red Hat Enterprise Linux BaseOS TUS (v.8.8) openssl 1.1.1k-16.el8_6, openssl-libs 1.1.1k-16.el8_6, openssl-perl 1.1.1k-16.el8_6
    fixed: vendor fix RHSA-2026:26275
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) openssl 1.0.1e-61.el6_10.1
    fixed: vendor fix RHSA-2026:66524
  • Red Hat Enterprise Linux Server (v. 7 ELS) openssl 1.0.2k-26.el7_9.2, openssl-libs 1.0.2k-26.el7_9.2
    fixed: vendor fix RHSA-2026:58563
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) openssl-static 1.0.1e-61.el6_10.1
    fixed: vendor fix RHSA-2026:66524
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) openssl-perl 1.0.2k-26.el7_9.2
    fixed: vendor fix RHSA-2026:58563
  • Red Hat Hardened Images bootupd 0.3.2-1.hum1, chunkah 0.6.0-3.hum1, openssl 3.5.8-0.1.hum1, openssl3 3.5.8-0.1.hum1, ruby4.0 4.0.6-37.3.hum1, ruby3.3 3.3.10-23.6.hum1, +20 more
    fixed: vendor fix RHSA-2026:67551
  • Red Hat Insights proxy 1.5 insights-proxy/insights-proxy-container-rhel9 1782890503
    fixed: vendor fix RHSA-2026:34102
  • Red Hat JBoss Web Server 6.2.5
    fixed: vendor fix RHSA-2026:73982
  • Red Hat JBoss Web Server 7.0.2
    fixed: vendor fix RHSA-2026:76956
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1793042072, rhai/base-image-cpu-rhel9 1793329709, rhai/base-image-tpu-rhel9 1793041987, rhai/base-image-cuda-rhel9 1793042067, rhai/base-image-cuda-rhel9 1793328358, rhai/base-image-rocm-rhel9 1793041981, +1 more
    fixed: vendor fix RHSA-2026:94459
  • Red Hat OpenShift AI 3.4 rhai/base-image-cpu-rhel9 1793042088, rhai/base-image-tpu-rhel9 1793042006, rhai/base-image-gaudi-rhel9 1793042011, rhai/base-image-spyre-rhel9 1793042074, rhai/base-image-neuron-rhel9 1793042008, rhai/base-image-rocm-6.4-rhel9 1793041995, +4 more
    fixed: vendor fix RHSA-2026:91241
  • Red Hat OpenShift AI 3.5 rhai/base-image-cpu-rhel9 1793042162, rhai/base-image-tpu-rhel9 1793042010, rhai/base-image-gaudi-rhel9 1793042004, rhai/base-image-rubin-rhel9 1793042092, rhai/base-image-spyre-rhel9 1793042114, rhai/base-image-neuron-rhel9 1793042008, +4 more
    fixed: vendor fix RHSA-2026:91204
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157
    fixed: vendor fix RHSA-2026:59831
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202610241701
    fixed: vendor fix RHSA-2026:89651

3 more fixed, 24 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

4.00% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia AppBundler
>=1.0.0, <1.0.1
1.0.1
julia OpenSSL_jll
<3.5.7+0
3.5.7+0
julia Openresty_jll
all versions
 no fix listed

Affected products

  • OpenSSL OpenSSL
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Cost Management 4
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat JBoss Core Services
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat JBoss Web Server 7
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.