VULNpocalypse

CVE-2026-45447: Heap Use-After-Free in the PKCS7_verify() Function

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-08 00:03 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Description quoted from the CVE record (assigned by openssl, published 2026-06-09).

Weakness: CWE-416 Use After Free; Expired Pointer Dereference

How it can be exploited

Exploitable over the network with low attack complexity needing low privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 1 code repository and 1 research write-up naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 17 references on Exploit Observer

Live scores

EPSS
0.040
some chance of attack soon
VEDAS
0.866
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Who is affected

ProductAffectedNot affected
OpenSSLfrom 4.0.0 before 4.0.1
from 3.6.0 before 3.6.3
from 3.5.0 before 3.5.7
from 3.4.0 before 3.4.6
from 3.0.0 before 3.0.21
from 1.1.1 before 1.1.1zh
from 1.0.2 before 1.0.2zq		Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21, 1.1.1zh, 1.0.2zq.

Vendor guidance:

17 more

How to detect it

There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.

Advisories on this CVE

References

Vendor advisories and patches

13 more

Technical analysis and advisories

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust