We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 10·5 min read
CVE-2026-45447: Heap Use-After-Free in the OpenSSL PKCS7_verify() Function
TL;DR
A vulnerability existed in OpenSSL's PKCS7_verify() function, allowing a heap use-after-free condition. This was identified when parsing a specially crafted DER-encoded ASN.1 structure exceeding 2 gigabytes.
✦ Why It Matters
Engineers must ensure they are using supported OpenSSL versions to protect against critical vulnerabilities.
Key Takeaways
- Upgrade to supported OpenSSL versions immediately.
- Regularly audit cryptographic libraries for vulnerabilities.
- Understand the implications of heap use-after-free vulnerabilities.
- Stay informed about security updates and patches.
Full Summary
OpenSSL, a widely used cryptographic library, had a security vulnerability identified as CVE-2026-45447. This issue arises when the PKCS7_verify() function processes a DER-encoded ASN.1 structure with a primitive element that exceeds 2 gigabytes in length, leading to a heap use-after-free condition on 64-bit Unix and Unix-like systems.
The vulnerability can potentially allow attackers to exploit memory management errors, leading to unauthorized access or crashes. Engineers are advised to upgrade to supported versions of OpenSSL, as all versions prior to 1.1.1 are no longer receiving updates.
The discovery emphasizes the importance of regular security audits and updates in cryptographic libraries. By addressing this vulnerability, the integrity and security of applications using OpenSSL can be significantly improved.