CVE-2026-45447 — OpenSSL Vulnerability Details

What is CVE-2026-45447?

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

The record classifies CVE-2026-45447 under weakness classes CWE-416, CWE-825. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 140 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 4.0% probability of exploitation in the next 30 days, higher than 90.2% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 10/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-06-09, last modified 2026-09-18

Is CVE-2026-45447 being exploited?

Weaponised exploit code for CVE-2026-45447 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 36 in the Threadlinqs vulnerability feed.

0xBlackash/CVE-2026-45447 (github)
HORKimhab/CVE-2026-45447 (github)

Affected products and versions

OpenSSL: OpenSSL

How to fix CVE-2026-45447

No vendor patch reference has been recorded for CVE-2026-45447 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-45447

1 tracked threat in the Threadlinqs corpus references CVE-2026-45447, either in the campaign’s CVE list or as an indicator on the campaign record.

HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte Payload — MEDIUM · 2026-07-17

Sources

Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

Vendor advisory and patch

Showing 5 of 6 recorded references.