OpenSSL Security Updates – 10 June 2026

The addressed vulnerabilities could allow the attacker to perform denial-of-service attacks, bypass security restrictions, obtain sensitive information, gain elevated privileges, or execute arbitrary code on the affected system.

Sample of the addressed vulnerabilities:

1. OpenSSL Heap Use-After-Free in the PKCS7_verify() Function Vulnerability (CVE-2026-45447):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

2. OpenSSL Trust-Anchor Substitution via Cert/Issuer Typo in CMP rootCaKeyUpdate Vulnerability (CVE-2026-42769):

• CVSS: 5.3
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges