Skip to content
Critical OpenSSL Vulnerabilities Enable Remote Code Execution Attacks

Critical OpenSSL Vulnerabilities Enable Remote Code Execution Attacks

First seen 11 Jun 2026, 11:57 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 12, 2026 at 11:08 UTC
  • •CVE-2026-45447 allows remote code execution via crafted PKCS7 messages.
  • •CVE-2026-42768 and CVE-2026-42769 pose additional risks, including message decryption.
  • •Patches for all vulnerabilities were released; immediate application is advised.

OpenSSL has disclosed critical vulnerabilities that could allow remote code execution through specially crafted PKCS7 or S/MIME signed messages. The primary vulnerability, CVE-2026-45447, is a heap use-after-free bug in the PKCS7_verify function, enabling attackers to corrupt memory and execute arbitrary code. Other vulnerabilities include CVE-2026-42768, which allows attackers to decrypt signed messages, and CVE-2026-42769, which could enable root certificate replacement. All vulnerabilities were published on June 9, 2026, and while there are currently no known active exploits, the potential for attacks exists. Administrators are urged to apply patches promptly to mitigate risks. The vulnerabilities affect various applications utilizing OpenSSL for SSL/TLS implementations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 92d ago How this analysis works

Timeline

2026-06-09
CVE-2026-45447 published
OpenSSL disclosed a critical heap use-after-free vulnerability in PKCS7_verify, enabling remote code execution.
Cybersecuritynews
2026-06-09
CVE-2026-42768 published
A vulnerability that allows attackers to decrypt signed messages using a victim's RSA key was disclosed.
Cybersecuritynews
2026-06-09
CVE-2026-42769 published
This vulnerability could enable attackers to replace root certificates, posing additional security risks.
Cybersecuritynews
2026-06-11
OpenSSL vulnerabilities reported
Heise.De reported on the vulnerabilities, emphasizing the need for prompt patching by administrators.
Heise.De

More articles in this cluster (2)

Following this threat?

Track CVE-2026-42768 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3