CVE-2026-45447Patch(openssl / openssl)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch openssl openssl systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

openssl CVEs Back to dashboard

2.3/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://openssl-library.org/news/secadv/20260609.txt

Other references

Weakness type (CWE)

CWE-416CWE-825

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openssl

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
23 mentions across 9 observed days
Momentum state: declining

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 12 signals
Technical details provided in 17 signals
Disclosure: 8 classified signals
General: 3 classified signals
Peaked 7d ago at 7 mentions (2026-06-10); latest day: 1
23 total mentions across 9 days

Affected systems

Vendors

openssl

Products

openssl

1 version affected across 1 product

Deep dive

Activity timeline23 mentions / 9d

Signal classification4 categories

Patch

1147.8%

Disclosure

834.8%

General

313.0%

PoC

14.3%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	6	Disclosure3Patch3
2026-06-10	7	Disclosure2Patch4PoC1
2026-06-11	2	Disclosure1Patch1
2026-06-12	2	Patch2
2026-06-16	2	General1Patch1
2026-06-17	1	Disclosure1
2026-06-18	1	Disclosure1
2026-06-23	1	General1
2026-07-05	1	General1

Full discourse20 posts

elhacker.NET@elhackernet136d
Disclosure
Vulnerabilidades críticas de OpenSSL permiten ejecución remota de código OpenSSL ha emitido un aviso de seguridad alertando sobre una vulnerabilidad crítica (CVE-2026-45447) https://blog.elhacker.net/2026/06/vulnerabilidades-criticas-de-openssl.html
Post summary
OpenSSL has released a security advisory for CVE-2026-45447, labeling it a critical vulnerability that could allow remote code execution, but no proof of concept, exploit code, or detailed technical data is disclosed.
1421116385.3K
141.0K followersView on X
Open Source Security mailing list@oss_security128d
Disclosure
OpenSSL Security Advisory [9th June 2026] https://www.openwall.com/lists/oss-security/2026/06/09/15 18 CVEs, including one "Severity: High" affecting 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2 CVE-2026-45447: Heap Use-After-Free in the PKCS7_verify() Function
Post summary
The advisory announces 18 CVEs, including a high‑severity heap use‑after‑free vulnerability (CVE-2026-45447) affecting multiple OpenSSL versions and giving technical details of the flaw.
02050383
4.7K followersView on X
America's Pick@nims213137d
Patch
OpenSSL Patches High-Severity Vulnerability Found With AI https://ift.tt/03vXCzm The latest OpenSSL releases patch 18 vulnerabilities, including a high-severity issue that could allow remote code execution. The high-severity vulnerability, tracked as CVE-2026-45447, is a h…
Post summary
The article announces that recent OpenSSL releases have patched CVE‑2026‑45447, a high‑severity remote code execution flaw.
0202276
1.7K followersView on X
🕳@sekurlsa_pw136d
Disclosure
OpenSSL Security Advisory 9th June 2026 https://openssl-library.org/news/secadv/20260609.txt Heap Use-After-Free in the PKCS7_verify() Function (CVE-2026-45447) is the only one rated high in severity. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are vulnerable to this issue https://t.co/knUX9GaAaW
Post summary
An OpenSSL advisory announced a high‑severity heap use‑after‑free bug (CVE‑2026‑45447) affecting multiple OpenSSL releases; no PoC, exploit code, patch details, or active exploitation are mentioned.
02030659
2.7K followersView on X
Elusive@ElusivePrivacy136d
Patch
OpenSSL high-severity bug OpenSSL patched 18 bugs, including a rare high-severity one: CVE-2026-45447, a heap use-after-free in PKCS#7 verification. A crafted PKCS#7/S/MIME signed message with an empty digestAlgorithms SET can make PKCS7_verify() free a caller-owned BIO → use-after-free, heap corruption, possible RCE. High-severity in OpenSSL is rare only the 2nd of 2026. Notable: it was found by a Calif researcher working with Claude AI. AI-assisted code audit is quietly becoming standard practice. Update OpenSSL. Source: @SecurityWeek @VulnerabilityNews
Post summary
OpenSSL has patched 18 vulnerabilities, including the rare, high‑severity CVE‑2026‑45447—a heap use‑after‑free in PKCS#7 verification—providing a clear patch and detailed technical description.
0101177
184 followersView on X
Kazuki Omo@omokazuki136d
Disclosure
SIOSセキュリティブログを更新しました。 OpenSSLの脆弱性(High: CVE-2026-45447, Moderate: 5件,Low:12件)と 4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21, 1.1.1zh ,1.0.2zqのリリース #sios_tech #security #vulnerability #セキュリティ #脆弱性 #ssl #openssl https://security.sios.jp/vulnerability/openssl-security-vulnerability-20260610/
Post summary
The post announces an OpenSSL vulnerability (CVE-2026-45447) with high severity, noting affected releases but providing no PoC, exploit details, or evidence of active exploitation.
00021167
372 followersView on X
Ferramentas Linux@Cezar_H_Linux130d
General
OpenSSL no openSUSE: 5 CVEs críticas (CVE-2026-45447, CVE-2026-42766, CVE-2026-9076, CVE-2026-7383, CVE-2026-34180). Saiba mais: -> https://tinyurl.com/mtx3npu9 #openSUSE https://t.co/tRrkR6h5YK
Post summary
The tweet alerts that five OpenSSL CVEs are considered critical on openSUSE but does not provide technical details, exploit information, or remediation guidance.
1001049
1.5K followersView on X
TrinityDox｜業務改善とAI活用の実務家@TrinityDox_JP134d
Patch
何十年も専門家のレビューをくぐり抜けてきた脆弱性を、AIが掘り起こし始めました。 2026年6月9日、OpenSSLプロジェクトが高危険度の脆弱性「CVE-2026-45447」を含む計18件の脆弱性を公表し、修正版を公開しました。対象は PKCS#7 API を使ってメッセージを処理するアプリケーション全般で、条件次第では遠隔からの任意コード実行につながる可能性があります。この18件のうち7件において、Anthropicのセキュリティ研究者およびClaudeが報告者としてクレジットされています。 Claudeを活用したセキュリティ分析の実績は、これだけではありません。 Claude Opus 4.6を用いたAnthropicチームは、本番環境のオープンソースコードベースで500件以上の高危険度の脆弱性を発見したと公表しました。その中には、数十年間、専門家のレビューをくぐり抜けてきたバグも含まれています。 AIセキュリティスタートアップのAISLEも、2025年に割り当てられたOpenSSLのCVE 14件中13件をAIシステムが発見したと報告しています。静的解析ツールが既知のパターンしか拾えないのに対し、AIは文脈を横断して、複雑な脆弱性の候補まで大量に洗い出します。ただし、AIに丸投げすれば完結する、という話ではありません。 Claude Securityの公式仕様では、AIが提案した変更は必ず人間のレビューに委ねられ、承認がなければ何もリリースされません。多段階検証で偽陽性をふるい落とし、重大度と信頼度のレーティングを付けて、優先順位付きのリストにしてチームに渡します。見つかった数に比べて開示件数が少ないのも、人間によるトリアージが追いついていないからです。精度面でも課題は残ります。CやC++などメモリ安全性のない言語では誤検知率が高くなりやすく（Cloudflareらの評価）、エージェント型の解析は本質的に非決定的なため、同じコードでも実行ごとに検出結果が変わりうる点をAnthropic自身が認めています。 DX推進担当やプロジェクトマネージャーが今すぐ検討できるのは、三つの問いを立てることです。一つ目は「既存のコードレビュープロセスのどの段階にAIの候補出力を差し込むか」。全件確認ではなく、高優先度の案件だけに絞る設計が現実的です。二つ目は「レビュアーの工数をAI導入後にどう再配分するか」。AIが候補を増やす分、人間のトリアージ負荷は導入初期に跳ね上がります。三つ目は「C・C++を使っているコンポーネントを把握しているか」。誤検知が増えやすい言語を先に押さえておくと、レビュー優先度の設計が引き締まります。 AIはセキュリティの「全自動化」ではなく、「見落としを減らすための網」です。その網をどこに張るかは、結局のところ人が決めます。参考: https://atmarkit.itmedia.co.jp/ait/articles/2606/12/news055.html 業務AI・DX推進の実務情報を毎朝・夕配信中→ @TrinityDox_JP をフォロー #TrinityDox #Claude #AI活用 #DX推進 #セキュリティ
Post summary
AI‑driven security research has uncovered numerous vulnerabilities; OpenSSL has patched 18, including CVE‑2026‑45447 which affects PKCS#7 API and could allow remote code execution, with a remedy now available.
00020315
29 followersView on X
Cybersecurity News Everyday@TweetThreatNews136d
Patch
OpenSSL released fixes for 18 vulnerabilities, including CVE-2026-45447, a high-severity heap use-after-free in PKCS#7 and S/MIME verification that could lead to crashes or remote code execution. #OpenSSL #CVE202645447 #SMIME https://ift.tt/30VHZ6U
Post summary
OpenSSL has disclosed patches for 18 vulnerabilities, including CVE-2026-45447—a heap use-after-free in PKCS#7/S/MIME that could result in crashes or remote code execution.
00011141
4.4K followersView on X
Ferramentas Linux@Cezar_H_Linux130d
Patch
🚨 Administradores #openSUSE: atualização crítica do OpenSSL disponível. CVE-2026-45447 permite execução remota de código via mensagens PKCS#7 maliciosas. Saiba mais: -> http://tinyurl.com/yck5tb5k https://t.co/I0GAydHCkv
Post summary
OpenSUSE admins are urged to apply a critical OpenSSL update for CVE-2026-45447, which permits remote code execution through malicious PKCS#7 messages.
1000052
1.5K followersView on X
Helios Mier@hmier136d
Patch
OpenSSL 4.0.1 CVE-2026-45447 heap user-after-free en la funcion PKCS7_verify() al recibir mensajes con s/mime el CVE mas alto es severidad HIGH... y de bastante niche. de cualquier manera hay que esperar a que las distros preparen el paquete y solo aplicar en tu proximo matto.
Post summary
The post highlights a high‑severity heap USAF bug in OpenSSL’s PKCS7_verify and advises waiting for distribution package updates to mitigate the issue.
00010122
1.7K followersView on X
IntegSec@integ_sec111d
General
CVE-2026-45447: OpenSSL PKCS#7 Use-After-Free Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04ny2Tk0
Post summary
The text outlines a general discussion of CVE‑2026‑45447, highlighting its nature as a Use‑After‑Free in OpenSSL PKCS#7 and summarizing business implications and response strategies, but it lacks specific indicators of PoC, exploit, patch, or active exploitation.
0000035
31 followersView on X
CERT-PY@CERTpy123d
General
⚠️ Vulnerabilidades en productos OpenSSL ❗ CVE-2026-9076 ❗ CVE-2026-7383 ❗ CVE-2026-45447 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-openssl/ https://t.co/yaTVoQCWnH
Post summary
The tweet lists three OpenSSL CVEs and links to an external page for more information, but provides no details on PoC, exploitation, or mitigation.
00000252
6.7K followersView on X
iototsecnews@iototsecnews129d
Disclosure
OpenSSL の脆弱性 CVE-2026-45447 などが FIX：任意のコード実行の可能性 https://iototsecnews.jp/2026/06/10/critical-openssl-vulnerabilities-enable-remote-code-execution-attacks/ OpenSSL の脆弱性 CVE-2026-45447 の原因は、PKCS7_verify 関数において、空のデータを含む特別なメッセージを処理する際のメモリ管理の不備にあります。この欠陥により、内部で BIO というオブジェクトが解放された後も、アプリケーション側が事実を認識できずに再利用してしまう use-after-free という状態が引き起こされます。その結果、メモリの破壊が発生し、最悪の場合には外部から任意のプログラムを実行されてしまう危険性が生まれます。ご利用のチームは、ご注意ください。 #CVE202645447 #OpenSSL #Vulnerability
Post summary
The post discloses a use‑after‑free flaw in OpenSSL’s PKCS7_verify function that could enable arbitrary code execution, but it provides no PoC, exploit, or patch details.
00000119
499 followersView on X
セキュリティ対策Lab@securityLab_jp134d
Patch
OpenSSLがAIで発見された危険度の高い脆弱性 CVE-2026-45447 を含む18件を修正 https://rocket-boys.co.jp/security-measures-lab/openssl-ai-discovered-vulnerability-cve-2026-45447/ #セキュリティ対策Lab #security #securitynews
Post summary
The article announces that CVE‑2026‑45447, a high‑risk OpenSSL vulnerability, is among 18 bugs that have been fixed, but it provides no PoC, exploit details, or active exploitation evidence.
00000134
428 followersView on X
Daily Security Review@securitydailyr134d
Patch
OpenSSL patches 16 flaws: CVE-2026-45447, heap use-after-free in PKCS7_verify() with RCE potential via crafted S/MIME. Also: unauthenticated QUIC DoS (CVE-2026-34183) and key forgery (CVE-2026-34182). Check static builds. https://dailysecurityreview.com/resources/openssl-patches-16-flaws-including-heap-use-after-free-rce-risk/ #CyberSecu https://t.co/nC2CFxcNTX
Post summary
The tweet highlights OpenSSL patch releases for several CVEs, providing technical details of the flaws and urging users to verify static builds, with no evidence of active exploitation or PoC sharing.
0000045
118 followersView on X
pp4mnk ⚙️ Developer. Hacker. Optimizer. ⚡DEV@pp4mnk_style135d
Disclosure
CRÍTICO: vulnerabilidad en OpenSSL permite ejecución remota de código (RCE) OpenSSL acaba de alertar sobre CVE-2026-45447, una falla crítica que podría permitir a atacantes ejecutar código remoto en sistemas vulnerables. #CyberSecurity #Linux #OpenSSL #InfoSec #CyberThreat #SysA
Post summary
OpenSSL has announced a critical CVE-2026-45447 that could allow remote code execution, but no additional exploitation details, PoC, or mitigation information are included.
0000064
692 followersView on X
Aikido Community Japan@AikidoCommJP135d
Disclosure
AIが見つけたOpenSSLの脆弱性 ── 「全CVEを追いながら仕事はできない」時代にどう備えるか 2026年6月9日のOpenSSL大型アップデート(18件修正)で、High-severityのCVE-2026-45447(PKCS#7 use-after-free、RCE可能性)が公開。発見にはAnthropicのClaude AIが関与しました。全CVEを人手で追うのは非現実的——無料枠での可視化から、SCA+reachability+SASTによる「直すべきものだけ」への集中まで、現実的な備え方を解説します。 High-severityのOpenSSL脆弱性、発見者は「人間+AI」 2026年6月9日、OpenSSLプロジェクトは計18件の脆弱性を修正するアップデートをリリースしました。中でも注目はHigh-severityの CVE-2026-45447。PKCS#7署名検証処理におけるheap use-after-freeで、細工されたPKCS#7またはS/MIME署名メッセージを処理させることでトリガーされます。結果として、heap破壊、プロセスクラッシュ、そして条件次第ではリモートコード実行(RCE)に至る可能性があります。 #Aikido #Security #OpenSSL #CVE https://aikido-community.jp/articles/openssl-cve-2026-45447-ai-2026
Post summary
The post announces the discovery of CVE-2026-45447 in OpenSSL, outlines its technical details and potential exploitation (RCE), notes that a patch update was released, but does not report any active exploitation or exploit code.
00000156
48 followersView on X
foursignals@foursignalsdev136d
Patch
CVE-2026-45447 hits OpenSSL's PKCS7_verify() with a heap use-after-free. Patch now—this affects TLS/PKI everywhere. https://www.foursignals.dev/wire/2026-06-10/cve-2026-45447-heap-use-after-free-in-the-openssl-pkcs7-e8c957
Post summary
The snippet announces CVE‑2026‑45447, a heap use‑after‑free flaw in OpenSSL’s PKCS7_verify, and stresses applying the available patch.
0000046
13 followersView on X
Can Artuc@canartuc136d
PoC
Thai Duong sent OpenSSL a crafted PKCS#7 message with an empty digestAlgorithms SET, and watched PKCS7_verify() free a BIO the caller still owned. That's CVE-2026-45447, high severity, heap corruption and in some contexts RCE. CMS API users dodged it. Still on legacy PKCS#7?
Post summary
Thai Duong demonstrated a heap corruption and potential RCE vulnerability (CVE‑2026‑45447) by sending a crafted PKCS#7 message, without providing exploit code, patch details, or evidence of active exploitation.
0000057
170 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openssl	openssl	-	-	-
App	openssl	openssl	4.0.0	-	-

Explore more

Back to dashboard openssl CVEs openssl vulnerabilities

What researchers are saying

CVE-2026-45447

America's Pick[verified]@nims213Patch

The article announces that recent OpenSSL releases have patched CVE‑2026‑45447, a high‑severity remote code execution flaw.

Elusive[verified]@ElusivePrivacyPatch

OpenSSL has patched 18 vulnerabilities, including the rare, high‑severity CVE‑2026‑45447—a heap use‑after‑free in PKCS#7 verification—providing a clear patch and detailed technical description.

TrinityDox｜業務改善とAI活用の実務家[verified]@TrinityDox_JPPatch

AI‑driven security research has uncovered numerous vulnerabilities; OpenSSL has patched 18, including CVE‑2026‑45447 which affects PKCS#7 API and could allow remote code execution, with a remedy now available.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

OpenSSL has disclosed patches for 18 vulnerabilities, including CVE-2026-45447—a heap use-after-free in PKCS#7/S/MIME that could result in crashes or remote code execution.

IntegSec[verified]@integ_secGeneral

The text outlines a general discussion of CVE‑2026‑45447, highlighting its nature as a Use‑After‑Free in OpenSSL PKCS#7 and summarizing business implications and response strategies, but it lacks specific indicators of PoC, exploit, patch, or active exploitation.

セキュリティ対策Lab[verified]@securityLab_jpPatch

The article announces that CVE‑2026‑45447, a high‑risk OpenSSL vulnerability, is among 18 bugs that have been fixed, but it provides no PoC, exploit details, or active exploitation evidence.

Aikido Community Japan[verified]@AikidoCommJPDisclosure

The post announces the discovery of CVE-2026-45447 in OpenSSL, outlines its technical details and potential exploitation (RCE), notes that a patch update was released, but does not report any active exploitation or exploit code.

Can Artuc[verified]@canartucPoC

Thai Duong demonstrated a heap corruption and potential RCE vulnerability (CVE‑2026‑45447) by sending a crafted PKCS#7 message, without providing exploit code, patch details, or evidence of active exploitation.