AI-assisted research discovers critical OpenSSL vulnerability
Researchers using Anthropic's Claude AI discovered a critical vulnerability (CVE-2026-45447) in OpenSSL affecting multiple version branches. The high-severity flaw in PKCS#7 signature verification could lead to remote code execution and prompted OpenSSL to patch the issue across seven version branches.
What happened
Researchers working with Anthropic's Claude AI discovered CVE-2026-45447, a critical vulnerability in OpenSSL's PKCS#7 signature verification process. The vulnerability, assigned a CVSS severity score of 8.8, could lead to use-after-free memory issues and potentially enable remote code execution.
Reported impact
The flaw affected multiple OpenSSL version branches including 1.0.2, 1.1.1, 3.0.0, 3.4.0, 3.5.0, 3.6.0, and 4.0.0. OpenSSL released patches across seven version branches to address the vulnerability.
Index analysis
The discovery demonstrates AI's role in identifying security vulnerabilities in critical infrastructure components. Anthropic personnel also contributed to discovering and reporting seven additional OpenSSL vulnerabilities in the same disclosure.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.