OpenSSL 1.1.1 < 1.1.1zh Multiple Vulnerabilities

CVE-2026-45447 is a heap use-after-free in OpenSSL's PKCS7_verify() function. When a specially crafted PKCS#7 or S/MIME signed message arrives with an empty SignedData.digestAlgorithms ASN.1 SET, OpenSSL frees a caller-owned BIO while the application still holds a reference. Depending on heap allocator behavior, this yields crashes, heap corruption, or potentially attacker-controlled code execution. It affects every OpenSSL release line — 1.0.2 through 4.0 — but the fix for 1.1.1 (version 1.1.1zh) is only available through paid extended support because 1.1.1 went EOL in September 2023. The remaining four CVEs in this plugin (CVE-2026-7383, CVE-2026-34180, CVE-2026-42766, CVE-2026-9076) are all rated Low by OpenSSL and require impractical preconditions like half-a-gigabyte attacker-controlled strings or >2 GB ASN.1 primitive elements.

The user-reported vendor severity of MEDIUM understates the risk. OpenSSL's own advisory rates CVE-2026-45447 as High (CVSS 8.1, AC:H), and Tenable's VPR of 7.6 (98th percentile) agrees. The MEDIUM label likely comes from an aggregated bulletin (e.g., HKCERT) that averages across all 18 CVEs in the June 2026 advisory. That averaging hides the headline bug. The four Low-severity CVEs are noise — the entire plugin's priority should be driven by CVE-2026-45447 and the fact that you're running a library three years past end-of-life.

1. Audit for PKCS7_verify() callers in your application inventory — The attack surface is limited to applications calling the legacy PKCS#7 API on untrusted data. Run grep -r 'PKCS7_verify\|openssl_pkcs7_verify' /your/codebase and check dynamically linked applications with nm -D or objdump -T against libssl/libcrypto. Prioritize any hits on internet-facing services (email gateways, web apps). Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Migrate off OpenSSL 1.1.1 to a supported branch — OpenSSL 1.1.1 has been EOL since September 2023. The real fix is migrating to 3.4.x LTS, 3.5.x, 3.6.x, or 4.0.x. If you're paying for extended support, apply 1.1.1zh immediately. If you're not paying for extended support, you're not getting patches at all and migration is the only path. Target remediation within 180 days per noisgate remediation SLA for HIGH.
3. Block or quarantine malformed S/MIME at the email gateway — If your email infrastructure processes S/MIME, configure your email security gateway (Proofpoint, Mimecast, Microsoft Defender for Office 365) to strip or quarantine S/MIME signed messages with malformed ASN.1 structures. This is a blunt instrument but reduces the primary delivery vector. Deploy within 30 days.
4. Enable ASLR and heap hardening on all hosts — Ensure ASLR is enabled (/proc/sys/kernel/randomize_va_space = 2) and that you're running glibc ≥2.32 with safe-linking enabled. These mitigations don't prevent the use-after-free but significantly raise the bar for achieving controlled code execution from a crash. Verify immediately.
5. Deploy WAF rules for PKCS#7 content types on web application endpoints — If web applications accept PKCS#7 uploads (content-type application/pkcs7-mime or application/x-pkcs7-mime), add WAF rules to inspect and rate-limit these uploads. This provides defense-in-depth for the PHP openssl_pkcs7_verify() attack path.

Run this script on each target host as any user with read access to the OpenSSL binary. Invoke with: bash check_cve_2026_45447.sh — no arguments needed. It checks the installed OpenSSL version against the patched release (1.1.1zh). For fleet-wide use, push via Ansible/Salt/SSH and collect exit codes (0 = patched, 1 = vulnerable, 2 = unknown).

#!/usr/bin/env bash
# check_cve_2026_45447.sh
# Checks whether the host is running an OpenSSL 1.1.1 version vulnerable to
# CVE-2026-45447 (Heap Use-After-Free in PKCS7_verify)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

OPENSSL_BIN="${OPENSSL_BIN:-openssl}"

if ! command -v "$OPENSSL_BIN" &>/dev/null; then
  echo "UNKNOWN - openssl binary not found in PATH"
  exit 2
fi

VERSION_STRING=$("$OPENSSL_BIN" version 2>/dev/null)
if [[ -z "$VERSION_STRING" ]]; then
  echo "UNKNOWN - could not determine OpenSSL version"
  exit 2
fi

echo "Detected: $VERSION_STRING"

# Extract major.minor.patch and letter suffix
if [[ "$VERSION_STRING" =~ OpenSSL\ 1\.1\.1([a-z]*) ]]; then
  SUFFIX="${BASH_REMATCH[1]}"
  # 1.1.1zh is the fixed version. Convert suffix to comparable form.
  # Suffixes go: (empty), a, b, ..., z, za, zb, ..., zg, zh
  # We need to check if suffix >= 'zh'
  if [[ -z "$SUFFIX" ]]; then
    echo "VULNERABLE - OpenSSL 1.1.1 (no patch letter) is affected"
    exit 1
  fi
  
  SUFFIX_LEN=${#SUFFIX}
  
  if [[ $SUFFIX_LEN -eq 1 ]]; then
    # Single letter suffix (a-z): all vulnerable
    echo "VULNERABLE - OpenSSL 1.1.1${SUFFIX} < 1.1.1zh"
    exit 1
  elif [[ $SUFFIX_LEN -eq 2 ]]; then
    # Double letter suffix (za-zz range)
    SECOND_CHAR="${SUFFIX:1:1}"
    if [[ "$SECOND_CHAR" < "h" ]]; then
      echo "VULNERABLE - OpenSSL 1.1.1${SUFFIX} < 1.1.1zh"
      exit 1
    else
      echo "PATCHED - OpenSSL 1.1.1${SUFFIX} >= 1.1.1zh"
      exit 0
    fi
  elif [[ $SUFFIX_LEN -gt 2 ]]; then
    # Suffix longer than 2 chars means newer than zh
    echo "PATCHED - OpenSSL 1.1.1${SUFFIX} >= 1.1.1zh"
    exit 0
  fi
elif [[ "$VERSION_STRING" =~ OpenSSL\ ([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
  MAJOR="${BASH_REMATCH[1]}"
  MINOR="${BASH_REMATCH[2]}"
  PATCH="${BASH_REMATCH[3]}"
  if [[ "$MAJOR" -eq 1 && "$MINOR" -le 0 ]]; then
    echo "VULNERABLE - OpenSSL ${MAJOR}.${MINOR}.${PATCH} is EOL and likely affected (check 1.0.2 separately)"
    exit 1
  elif [[ "$MAJOR" -ge 3 ]]; then
    echo "UNKNOWN - OpenSSL ${MAJOR}.${MINOR}.${PATCH} detected; this script checks 1.1.1 branch only. Check CVE-2026-45447 fixes for your branch."
    exit 2
  fi
else
  echo "UNKNOWN - unrecognized OpenSSL version string: $VERSION_STRING"
  exit 2
fi

1. Tenable Plugin 320139
2. OpenSSL Vulnerabilities (1.1.1 branch)
3. CVE-2026-45447 — IONIX Threat Center
4. Red Hat CVE-2026-45447
5. 0xBlackash PoC (crash only)
6. HKCERT Bulletin — OpenSSL Multiple Vulnerabilities
7. CyberSecurity News — OpenSSL RCE Vulnerability
8. FIRST EPSS API — CVE-2026-45447