CVE-2026-45447

/// Technical description

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could

trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap

corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData

digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may

incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent

use of the BIO by the calling application results in a use-after-free

condition.

In the common case this occurs when the application later calls

BIO_free() on the BIO originally passed to PKCS7_verify(). Depending

on allocator behavior and application-specific BIO usage patterns, this

may result in a crash or other memory corruption. In some application

contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL

PKCS#7 APIs may be affected. A

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References