CVE-2026-45447: OpenSSL PKCS#7 Use-After-Free Leading to RCE

Technical summary

The vulnerability exists in OpenSSL's PKCS7_verify() function during the processing of PKCS#7 or S/MIME signed messages. Specifically, when the SignedData.digestAlgorithms field is an empty ASN.1 SET, OpenSSL incorrectly calls free() on a BIO (Basic Input/Output abstraction) object that was passed in by the caller. The BIO lifecycle should be managed entirely by the calling application; OpenSSL should not free it. After PKCS7_verify() returns, the caller's application typically calls BIO_free() on that same BIO, triggering a use-after-free. The root cause is CWE-416 (use-after-free) combined with CWE-825 (improper handling of object lifetime). The vulnerability does not affect applications using OpenSSL's newer CMS APIs, only those using the legacy PKCS#7 APIs. FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are unaffected because the vulnerable code lies outside the FIPS module boundary.

Business impact

Organizations deploying OpenSSL-based applications that process digitally signed emails or PKCS#7 messages face a significant operational risk. Exploitation can lead to application crashes, degrading service availability. More critically, if an attacker can craft and send a malicious signed message to a targeted application, they may achieve remote code execution with the privileges of that application—potentially compromising the entire system. Financial and healthcare organizations that rely on S/MIME for secure communications are particularly exposed. The attack requires an authenticated message sender, which narrows but does not eliminate the attack surface in many enterprise environments. Downtime, data breach, and compliance violations are all realistic outcomes if this is not patched promptly.

Affected systems

All applications linked against or embedding OpenSSL and using the PKCS#7 APIs (specifically PKCS7_verify()) to validate signed messages are potentially affected. This includes mail servers, email clients, document signing tools, and any custom application that validates PKCS#7 or S/MIME signatures. Applications using OpenSSL's CMS API instead of the legacy PKCS#7 API are not affected. FIPS-validated deployments of OpenSSL 4.0, 3.6, 3.5, 3.4, or 3.0 operating in FIPS mode are not affected. Verify the exact OpenSSL version and which API your application uses; consult your vendor's advisory for definitive patch guidance.

Exploitability

An attacker must be able to send or cause the vulnerable application to process a specially crafted PKCS#7 or S/MIME signed message with an empty digestAlgorithms field. The attack requires authentication or the ability to generate a message that the application will process, lowering the barrier to entry in many real-world scenarios. Network access is required, and there is no user interaction needed once a message reaches the vulnerable code. The CVSS score of 8.8 (HIGH) reflects high impact (confidentiality, integrity, and availability all compromised) paired with low attack complexity. The vulnerability is not yet on the CISA Known Exploited Vulnerabilities (KEV) list, but the technical simplicity of crafting the malicious message means exploit code is likely to emerge quickly once patches are available and defenders begin hunting.

Remediation

Apply the latest OpenSSL security patch from the vendor as soon as possible. The fix addresses the memory management logic in PKCS7_verify() to ensure that caller-owned BIO objects are not freed by OpenSSL. Test the patch in a non-production environment first, particularly if your application has custom BIO handling or memory allocation patterns. If you cannot patch immediately, consider restricting the application's ability to receive or process untrusted PKCS#7 or S/MIME messages, or isolate affected services behind additional authentication and validation layers. Review vendor advisories carefully, as patch versions vary by OpenSSL release series.

Patch guidance

Contact your OpenSSL distribution provider or visit the OpenSSL website for the latest security release. Patches are typically issued for multiple active release branches (e.g., 3.2, 3.1, 3.0, and legacy lines). Verify the patch version against the vendor's security advisory before deploying. If your application bundles OpenSSL statically, you must rebuild and redeploy the application. If your system uses OpenSSL as a shared library, updating the library package may be sufficient, but confirm with your application vendor. Test in a staging environment to ensure compatibility, especially if you have custom OpenSSL configurations or unusual BIO usage patterns.

Detection guidance

Monitor application logs for unexpected crashes or segmentation faults in processes that handle S/MIME or PKCS#7 message verification. A use-after-free often manifests as heap corruption warnings or crashes in memory allocation/deallocation code shortly after PKCS7_verify() is called. Use heap sanitizers (e.g., AddressSanitizer) in development and testing to catch use-after-free conditions before production. Endpoint detection and response (EDR) tools should flag abnormal process terminations or memory access violations in OpenSSL-linked applications. On the network side, look for unusual PKCS#7 or S/MIME message structures (e.g., messages with empty or malformed digestAlgorithms fields) sent to your mail servers or document processing services. If you have source access, code audits should verify that any calls to PKCS7_verify() correctly handle the BIO lifecycle and do not assume OpenSSL will manage it.

Why prioritize this

This vulnerability scores HIGH (8.8 CVSS) with potential for remote code execution, requires only low attacker complexity, and affects a widely used library. Although it requires authentication or message send capability, those barriers are low in many organizational contexts. The attack surface spans email systems, document signing tools, and any PKCS#7-aware application. The fact that it is not yet in the KEV list does not diminish urgency—exploit code typically appears within days of patch availability for such straightforward memory safety issues. Organizations should treat this as a critical remediation priority.

Risk score, explained

CVSS 8.8 (HIGH) is driven by: (1) Network-accessible attack vector, (2) Low attack complexity (no special conditions required beyond crafting a specific message), (3) Low privileges required (an authenticated sender), (4) High impact across confidentiality, integrity, and availability. The use-after-free combined with potential RCE in memory-sensitive applications justifies the severity rating. If the vulnerability were easier to exploit without authentication, the score would be higher; conversely, if exploitation required high complexity or had minimal impact, it would be lower. The score reflects a realistic threat to production systems handling S/MIME.

Frequently asked questions