CVE-2026-45447
highpriority · track · 11EPSS 0.040 · 90 %ileexploit · PoCCHDEEUFRNLRUUSEPSS · scored 2026-10-22
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No fix is available; mitigate or reduce exposure.
- No fix availableLabX Standardmettler_toledo_psirt
This vulnerability will be fixed in the upcoming releases
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- 0xBlackash/CVE-2026-45447CVE-2026-45447PoC · poc_in_github
- HORKimhab/CVE-2026-45447CVE-2026-45447 - DraftPoC · poc_in_github
affected products (103)
Products and version ranges known to be affected.
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0307Kwetsbaarheden verholpen in Oracle Database ProductenNL2026-08-19csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Database producten als de Database Server, Essbase, Autonomous Health Framework en de Application Testing Suite
- VDE-2026-088METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.42026-08-20csaf · mettler_toledo_psirtCH
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
- WID-SEC-W-2026-1852OpenSSL: Mehrere SchwachstellenDeutsch2026-06-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-2455Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-2919IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2026-2929Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2026-08-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, SQL-Injection-, serverseitige Request-Forgery- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Informationen offenzulegen oder zu manipulieren, Denial-of-Service-Zustände auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- CERTFR-2026-AVI-1345Multiples vulnérabilités dans les produits StormShieldFrançais2026-10-21vendor · certfrFR
- CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
- CERTFR-2026-AVI-1352Multiples vulnérabilités dans Oracle PeopleSoftFrançais2026-10-21vendor · certfrFR
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (36)
External citations — patches, advisories, analysis.
- https://github.com/openssl/openssl/releasesPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-45447cnnvd
- https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63cenisa_euvd
- https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8enisa_euvd
- https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54enisa_euvd
- https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496cenisa_euvd
- https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273eenisa_euvd
- https://openssl-library.org/news/secadv/20260609.txtenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan