AZL-89864 CVE-2026-45447 affecting package edk2 for versions less than 20240524git3e722403cd16-18

🗓️ 09 Jun 2026 17:17:19Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Use-after-free in edk2 via OpenSSL PKCS#7 verification enabling crash, heap corruption, or RCE.

Reporter	Title	Published	Views	Family All 270
FreeBSD	OpenSSL -- Multiple vulnerabilities	9 Jun 202600:00	–	freebsd
FreeBSD	FreeBSD -- Multiple vulnerabilities in OpenSSL	9 Jun 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: This Power System update is being released to address CVE-2026-45447	15 Aug 202617:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL	14 Jul 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	6 Jul 202615:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL	22 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	1 Jul 202622:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	26 Jun 202621:27	–	ibm
Tenable Nessus	Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-1853)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : edk2, --advisory ALAS2-2026-3363 (ALAS-2026-3363)	22 Jun 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45447

02 Sep 2026 06:51Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.8

EPSS0.03566

SSVC

edk2 use-after-free PKCS#7 verification OpenSSL heap corruption remote code execution