CVE-2026-45447: OpenSSL PKCS7_verify() heap use-after-free (High)
A crafted PKCS#7 or S/MIME signed message whose SignedData digestAlgorithms field is an empty SET makes OpenSSL free a caller-owned BIO inside PKCS7_verify(). When the application later uses or frees that BIO, the result is a use-after-free that can crash the process, corrupt the heap or, in some applications, potentially allow remote code execution. Software that verifies untrusted PKCS#7/S/MIME data through the PKCS#7 APIs is affected; applications that use the CMS APIs are not. OpenSSL rates the issue High, and every supported branch from 1.0.2 to 4.0 is affected.
- CVE-2026-45447CVE identifier
- 8.8CVSS 3.1 base score (high)
- 4.0%EPSS: chance of exploitation in the next 30 days (higher than 91% of CVEs)
- 2026-06-09published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- libssl/libcrypto are shared libraries: restart every service that has them loaded (web, mail, VPN, database servers, language runtimes) or reboot. Software with a bundled or statically linked OpenSSL needs its own update.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Affected and fixed versions
Affected:
- OpenSSL 4.0.0
- OpenSSL 3.6.0 before 3.6.3
- OpenSSL 3.5.0 before 3.5.7
- OpenSSL 3.4.0 before 3.4.6
- OpenSSL 3.0.0 before 3.0.21
- OpenSSL 1.1.1 before 1.1.1zh
- OpenSSL 1.0.2 before 1.0.2zq
Fixed in:
- OpenSSL 4.0.1
- OpenSSL 3.6.3
- OpenSSL 3.5.7
- OpenSSL 3.4.6
- OpenSSL 3.0.21
- OpenSSL 1.1.1zh (premium support)
- OpenSSL 1.0.2zq (premium support)
Am I affected?
openssl version
dpkg -l 'libssl*' openssl | grep ^ii
rpm -q openssl openssl-libs
sudo lsof -n 2>/dev/null | grep -E 'lib(ssl|crypto)\.so.*\(deleted\)' | awk '{print $1, $2}' | sort -uPatch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade openssl libssl3 libssl3t64Ubuntu
sudo apt update
sudo apt install --only-upgrade openssl libssl3 libssl3t64RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh openssl openssl-libsSUSE / openSUSE
sudo zypper refresh
sudo zypper update openssl-3 libopenssl3Built from source
Upgrade to OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6 or 3.0.21 (or later) and rebuild anything that links OpenSSL statically.General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | openssl | fixed | 3.0.20-1~deb12u2 |
| Debian 13 | openssl | fixed | 3.5.6-1~deb13u2 |
| Debian testing | openssl | fixed | 3.6.3-1 |
| Red Hat Enterprise Linux 9 | openssl-1:3.5.5-4.el9_8 | fixed | RHSA-2026:25239 |
| Red Hat Enterprise Linux 9 | compat-openssl11-1:1.1.1k-5.el9_8.4 | fixed | RHSA-2026:44438 |
| Red Hat Enterprise Linux 8 | compat-openssl10-1:1.0.2o-4.el8_10.3 | fixed | RHSA-2026:36215 |
| Red Hat Enterprise Linux 8 | openssl-1:1.1.1k-16.el8_6 | fixed | RHSA-2026:26275 |
| Red Hat Enterprise Linux 10 | openssl-1:3.5.5-4.el10_2 | fixed | RHSA-2026:25237 |
| Debian 13 (trixie) | openssl | fixed | 3.5.6-1~deb13u2 (DSA-6335-1) |
| Debian 12 (bookworm) | openssl | fixed | 3.0.20-1~deb12u2 (DSA-6335-1) |
| Ubuntu 26.04 LTS (resolute) | openssl | fixed | 3.5.5-1ubuntu3.2 (USN-8414-1) |
| Ubuntu 24.04 LTS (noble) | openssl | fixed | 3.0.13-0ubuntu3.11 (USN-8414-1) |
| Ubuntu 22.04 LTS (jammy) | openssl | fixed | 3.0.2-0ubuntu1.25 (USN-8414-1) |
| RHEL 10 | openssl | fixed | 3.5.5-4.el10_2 (RHSA-2026:25237) |
| RHEL 9 | openssl | fixed | 3.5.5-4.el9_8 (RHSA-2026:25239) |
| RHEL 8 | openssl | fixed | 1.1.1k-16.el8_6 (RHSA-2026:26275) |
| SUSE Linux Enterprise Server 16.0 | openssl-3 | fixed | 3.5.0-160000.8.1 |
| SUSE Linux Enterprise Server 15 SP7 | openssl-3 | fixed | 3.2.3-150700.5.36.1 |
| SUSE Linux Enterprise Server 15 SP7 | openssl-1_1 | fixed | 1.1.1w-150700.11.22.1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- OpenSSL lists no workaround. Only applications that verify PKCS#7 or S/MIME signed data with the PKCS#7 APIs (PKCS7_verify) are exposed; the CMS APIs and the OpenSSL FIPS modules are not affected.
Sources
- OpenSSL Security Advisory 2026-06-09
- OpenSSL vulnerabilities list
- CVE record CVE-2026-45447
- Debian DSA-6335-1 openssl
- Debian security tracker
- Ubuntu CVE page
- Red Hat CVE page
- SUSE CVE page
- https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
- https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
- https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
- https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
- https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
- CVE-2026-45447 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.