AZL-89876 CVE-2026-45445 affecting package edk2 for versions less than 20240524git3e722403cd16-18

🗓️ 09 Jun 2026 17:17:18Reported by GoogleType

osv🔗 osv.dev👁 3 Views

edk2 AES-OCB EVP_Cipher() one-shot discards IV causing nonce reuse and universal tag forgery.

Reporter	Title	Published	Views	Family All 132
FreeBSD	OpenSSL -- Multiple vulnerabilities	9 Jun 202600:00	–	freebsd
FreeBSD	FreeBSD -- Multiple vulnerabilities in OpenSSL	9 Jun 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL	14 Jul 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	6 Jul 202615:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL	22 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance	10 Aug 202612:41	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	1 Jul 202622:38	–	ibm
Tenable Nessus	Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-1853)	22 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : openssl (ALSA-2026:25237)	11 Jun 202600:00	–	nessus
Tenable Nessus	Debian dsa-6335 : libcrypto3-udeb - security update	10 Jun 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45445

30 Aug 2026 05:26Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.00603

SSVC

edk2 AES-OCB IV discarded nonce reuse universal forgery EVP_Cipher