CVE-2026-45447

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could<br /> trigger a use-after-free during PKCS#7 signature verification.<br /> <br /> Impact summary: A use-after-free may result in process crashes, heap<br /> corruption, or potentially remote code execution.<br /> <br /> When processing a PKCS#7 or S/MIME signed message, if the SignedData<br /> digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may<br /> incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent<br /> use of the BIO by the calling application results in a use-after-free<br /> condition.<br /> <br /> In the common case this occurs when the application later calls<br /> BIO_free() on the BIO originally passed to PKCS7_verify(). Depending<br /> on allocator behavior and application-specific BIO usage patterns, this<br /> may result in a crash or other memory corruption. In some application<br /> contexts this may potentially be exploitable for remote code execution.<br /> <br /> Applications that process PKCS#7 or S/MIME signed messages using OpenSSL<br /> PKCS#7 APIs may be affected. Applications using the CMS APIs for this<br /> processing are not affected.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this<br /> issue, as the affected code is outside the OpenSSL FIPS module boundary.