Use-After-Free vulnerability affecting OpenSSL

OpenSSL is a widely deployed open source cryptographic library, providing implementations of the TLS/SSL protocols as well as cryptographic primitives used in a large number of applications, web servers and network equipment. This library is affected by a vulnerability labeled CVE-2026-45447, resulting from incorrect memory management when verifying digital signatures in PKCS#7 or S/MIME messages. Exploitation of this vulnerability would allow an unauthenticated malicious actor to submit, via any network channel carrying PKCS#7 or S/MIME content, a specially crafted message that could lead to a process crash, heap corruption, or, depending on the behavior of the memory allocator and how the application uses memory, remote arbitrary code execution. It is classified high with a severity score of 8.8 according to CVSS V3.1.

• OpenSSL version 4.0.0;
• OpenSSL versions 3.6.x prior to 3.6.3;
• OpenSSL versions 3.5.x prior to 3.5.7;
• OpenSSL versions 3.4.x prior to 3.4.6;
• OpenSSL versions 3.0.x prior to 3.0.21;
• OpenSSL versions 1.1.1 prior to 1.1.1zh;
• OpenSSL versions 1.0.2 prior to 1.0.2zq;

RECOMMENDED ACTIONS:

• Update OpenSSL to its latest stable version depending on active deployment branch;