cyfenced.com →

[ CVE-2026-45447 · Published 9 Jun 2026 ]

Vulnerability in OpenSSL

CVSS 8.8 EPSS 4%6 agency advisoriesFix available

[ Description ]Official description

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1449

    Multiple vulnerabilities in Citrix products Translated from French

    Multiple vulnerabilities have been discovered in Citrix products. They allow an attacker to cause remote arbitrary code execution and privilege escalation.

    CVE-2022-36763CVE-2026-98432CVE-2022-36764+6 more CVEs
  • CERT-FRCERTFR-2026-AVI-1431

    Multiple vulnerabilities in the Red Hat Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-80887CVE-2026-54369CVE-2026-68138+130 more CVEs
  • CERT-FRCERTFR-2026-AVI-1385

    Multiple vulnerabilities in VMware products Translated from French

    Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

    CVE-2019-25013CVE-2017-9937CVE-2025-6395+4953 more CVEs
  • CERT-FRCERTFR-2026-AVI-1352

    Multiple vulnerabilities in Oracle PeopleSoft Translated from French

    Multiple vulnerabilities have been discovered in Oracle PeopleSoft. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-91471CVE-2026-91485CVE-2026-101450+148 more CVEs
  • CERT-FRCERTFR-2026-AVI-1351

    Multiple vulnerabilities in Oracle MySQL Translated from French

    Multiple vulnerabilities have been discovered in Oracle MySQL. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-101721CVE-2026-101632CVE-2026-101629+157 more CVEs
  • CERT-FRCERTFR-2026-AVI-1345

    Multiple vulnerabilities in StormShield products Translated from French

    Multiple vulnerabilities have been discovered in StormShield products. Some of them allow an attacker to cause arbitrary code execution, remote denial of service and a breach of data confidentiality.

    CVE-2026-56850CVE-2026-34181CVE-2026-113808+16 more CVEs

[ References ]References