# CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 is fixed in 42 products on 1 platform, first by efi-shell-aa64 2024.02-2ubuntu0.10, released August 24, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-63072 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0092 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2026 - Weakness: Out-of-bounds Write - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63072 ## Description Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | compat-openssl11 RHEL 9 | 1:1.1.1k-5.el9_8.6 | [RHSA-2026:80514](https://patchblox.com/security/data/fix/linux/rhsa-2026-80514.md) | Oct 12, 2026 | | Linux | compat-openssl11 almalinux 9 | 1:1.1.1k-5.el9_8.6 | [ALSA-2026:80514](https://patchblox.com/security/data/fix/linux/alsa-2026-80514.md) | Nov 7, 2026 | | Linux | compat-openssl11 ol 9 | 1:1.1.1k-5.el9_8.6 | [ELSA-2026-80514](https://patchblox.com/security/data/fix/linux/elsa-2026-80514.md) | Nov 7, 2026 | | Linux | compat-openssl11 rocky 9 | 1:1.1.1k-5.el9_8.6 | [RLSA-2026:80514](https://patchblox.com/security/data/fix/linux/rlsa-2026-80514.md) | Nov 7, 2026 | | Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-aa64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-aa64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-aa64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-aa64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [efi-shell-x64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | efi-shell-x64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [efi-shell-x64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-efi-shell-x64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | libssl1.0.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm6 | [libssl1.0.0 1.0.2n-1ubuntu5.13+esm6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.0.0-1.0.2n-1ubuntu5.13-esm6.md) | Aug 27, 2026 | | Linux | libssl1.1 Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm10 | [libssl1.1 1.1.1-1ubuntu2.1~18.04.23+esm10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.1-1.1.1-1ubuntu2.1-18.04.23-esm10.md) | Aug 27, 2026 | | Linux | libssl1.1 Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.24+esm5 | [libssl1.1 1.1.1f-1ubuntu2.24+esm5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssl1.1-1.1.1f-1ubuntu2.24-esm5.md) | Aug 27, 2026 | | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [libssl3 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [libssl3t64 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3t64-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [libssl3t64 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.22-1~deb12u1 | [DEBIAN-CVE-2026-63072](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63072.md) | Aug 26, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-63072](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63072.md) | Aug 26, 2026 | | Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-63072](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63072.md) | Aug 26, 2026 | | Linux | openssl RHEL 10 | 3.5.8-1.el10_2 | [RHSA-2026:67154](https://patchblox.com/security/data/fix/linux/rhsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl RHEL 8 | 1:1.1.1k-18.el8_6 | [RHSA-2026:85968](https://patchblox.com/security/data/fix/linux/rhsa-2026-85968.md) | Oct 21, 2026 | | Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm10 | [openssl 1.1.1-1ubuntu2.1~18.04.23+esm10](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl-1.1.1-1ubuntu2.1-18.04.23-esm10.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.24+esm5 | [openssl 1.1.1f-1ubuntu2.24+esm5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openssl-1.1.1f-1ubuntu2.24-esm5.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.29 | [openssl 3.0.2-0ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.29.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.15 | [openssl 3.0.13-0ubuntu3.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.13-0ubuntu3.15.md) | Aug 27, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl almalinux 8 | 1:1.1.1k-18.el8_6 | [ALSA-2026:85968](https://patchblox.com/security/data/fix/linux/alsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl ol 8 | 1:1.1.1k-18.el8_6 | [ELSA-2026-85968](https://patchblox.com/security/data/fix/linux/elsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl rocky 10 | 1:3.5.8-1.el10_2 | [RLSA-2026:67154](https://patchblox.com/security/data/fix/linux/rlsa-2026-67154.md) | Sep 15, 2026 | | Linux | openssl rocky 9 | 1:3.5.8-1.el9_8 | [RLSA-2026:67165](https://patchblox.com/security/data/fix/linux/rlsa-2026-67165.md) | Sep 15, 2026 | | Linux | openssl-1_1 sles 15.6 | 1.1.1w-150600.5.38.1 | [SUSE-SU-2026:3878-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3878-1.md) | Aug 31, 2026 | | Linux | openssl-1_1 sles 15.7 | 1.1.1w-150700.11.30.1 | [SUSE-SU-2026:4041-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4041-1.md) | Sep 7, 2026 | | Linux | openssl-1_1-livepatches sles 15.6 | 0.8-150600.11.9.1 | [SUSE-SU-2026:4036-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4036-1.md) | Sep 7, 2026 | | Linux | openssl-1_1-livepatches sles 15.7 | 0.8-150700.13.12.1 | [SUSE-SU-2026:4037-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4037-1.md) | Sep 7, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 | | Linux | openssl-3 sles 15.6 | 3.1.4-150600.5.64.1 | [SUSE-SU-2026:3866-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3866-1.md) | Aug 28, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 | | Linux | openssl-3-livepatches sles 15.6 | 0.6-150600.13.19.1 | [SUSE-SU-2026:4038-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4038-1.md) | Sep 7, 2026 | | Linux | openssl-3-livepatches sles 15.7 | 0.6-150700.16.12.1 | [SUSE-SU-2026:4040-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4040-1.md) | Sep 7, 2026 | | Linux | openssl-3-livepatches sles 16.0 | 0.6-160000.1.1 | [SUSE-SU-2026:23788-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23788-1.md) | Sep 16, 2026 | | Linux | openssl-3-x86_64-v3-livepatches sles 16.0 | 0.6-160000.1.1 | [SUSE-SU-2026:23585-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23585-1.md) | Aug 31, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel RHEL 8 | 1:1.1.1k-18.el8_6 | [RHSA-2026:85968](https://patchblox.com/security/data/fix/linux/rhsa-2026-85968.md) | Oct 21, 2026 | | Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-devel almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-devel almalinux 8 | 1:1.1.1k-18.el8_6 | [ALSA-2026:85968](https://patchblox.com/security/data/fix/linux/alsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-devel ol 8 | 1:1.1.1k-18.el8_6 | [ELSA-2026-85968](https://patchblox.com/security/data/fix/linux/elsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-devel ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs RHEL 8 | 1:1.1.1k-18.el8_6 | [RHSA-2026:85968](https://patchblox.com/security/data/fix/linux/rhsa-2026-85968.md) | Oct 21, 2026 | | Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-libs almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-libs almalinux 8 | 1:1.1.1k-18.el8_6 | [ALSA-2026:85968](https://patchblox.com/security/data/fix/linux/alsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-libs ol 8 | 1:1.1.1k-18.el8_6 | [ELSA-2026-85968](https://patchblox.com/security/data/fix/linux/elsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-libs ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl RHEL 8 | 1:1.1.1k-18.el8_6 | [RHSA-2026:85968](https://patchblox.com/security/data/fix/linux/rhsa-2026-85968.md) | Oct 21, 2026 | | Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-perl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-perl almalinux 8 | 1:1.1.1k-18.el8_6 | [ALSA-2026:85968](https://patchblox.com/security/data/fix/linux/alsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-perl ol 8 | 1:1.1.1k-18.el8_6 | [ELSA-2026-85968](https://patchblox.com/security/data/fix/linux/elsa-2026-85968.md) | Nov 7, 2026 | | Linux | openssl-perl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl-provider-legacy 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-static ol 8 | 2:1.1.1k-18.ksplice1.el8_6 | [ELSA-2026-500498](https://patchblox.com/security/data/fix/linux/elsa-2026-500498.md) | Nov 7, 2026 | | Linux | openssl1.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm6 | [openssl1.0 1.0.2n-1ubuntu5.13+esm6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl1.0-1.0.2n-1ubuntu5.13-esm6.md) | Aug 27, 2026 | | Linux | openvox-agent RHEL 10 | 8.30.0-1.el10sat | [RHSA-2026:85249](https://patchblox.com/security/data/fix/linux/rhsa-2026-85249.md) | Aug 25, 2026 | | Linux | ovmf Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [ovmf 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ovmf-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [ovmf 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ovmf-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [ovmf 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-amdsev Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-amdsev 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-amdsev-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-generic Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-generic 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-generic-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-ia32 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [ovmf-ia32 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-ia32-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-ia32 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-inteltdx Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-inteltdx 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-inteltdx-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [ovmf-legacy 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-legacy-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | ovmf-legacy Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [ovmf-legacy 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ovmf-legacy-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi-aarch64 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-aarch64-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi-aarch64 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-aarch64-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi-aarch64 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-aarch64-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-aarch64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-aarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-aarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-aarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 18.04.6 LTS (bionic) | 0~20180205.c0d9813c-2ubuntu0.3+esm3 | [qemu-efi-arm 0~20180205.c0d9813c-2ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-qemu-efi-arm-0-20180205.c0d9813c-2ubuntu0.3-esm3.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 20.04 LTS (focal) | 0~20191122.bd85bf54-2ubuntu3.6+esm1 | [qemu-efi-arm 0~20191122.bd85bf54-2ubuntu3.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-qemu-efi-arm-0-20191122.bd85bf54-2ubuntu3.6-esm1.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.7 | [qemu-efi-arm 2022.02-3ubuntu0.22.04.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-arm-2022.02-3ubuntu0.22.04.7.md) | Aug 24, 2026 | | Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-arm 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-loongarch64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-loongarch64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-loongarch64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.10 | [qemu-efi-riscv64 2024.02-2ubuntu0.10](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.10.md) | Aug 24, 2026 | | Linux | qemu-efi-riscv64 Ubuntu 26.04.1 LTS (resolute) | 2025.11-3ubuntu7.3 | [qemu-efi-riscv64 2025.11-3ubuntu7.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-qemu-efi-riscv64-2025.11-3ubuntu7.3.md) | Aug 24, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.