# ALSA-2026:25237: Security update for 4 packages

ALSA-2026:25237, released June 11, 2026, fixes 15 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-25237
- Platform: Linux
- Released: Jun 11, 2026
- Priority: High (Closes CVE-2026-45447, high severity)
- CVEs: 15, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:25237

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [openssl](https://patchblox.com/security/data/product/linux/openssl.md) | almalinux 10 | 1:3.5.5-4.el10_2.alma.1 |
| [openssl-devel](https://patchblox.com/security/data/product/linux/openssl-devel.md) | almalinux 10 | 1:3.5.5-4.el10_2.alma.1 |
| [openssl-libs](https://patchblox.com/security/data/product/linux/openssl-libs.md) | almalinux 10 | 1:3.5.5-4.el10_2.alma.1 |
| [openssl-perl](https://patchblox.com/security/data/product/linux/openssl-perl.md) | almalinux 10 | 1:3.5.5-4.el10_2.alma.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-45447](https://patchblox.com/security/data/cve/CVE-2026-45447.md) | High | Heap Use-After-Free in the PKCS7_verify() Function | 9.1 | 0.0400 |  |
| [CVE-2026-42764](https://patchblox.com/security/data/cve/CVE-2026-42764.md) | High | openssl: Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the Op... | 9.1 | 0.0117 |  |
| [CVE-2026-42766](https://patchblox.com/security/data/cve/CVE-2026-42766.md) | High | Possible NULL Dereference in Password-Based CMS Decryption | 9.1 | 0.0106 |  |
| [CVE-2026-34182](https://patchblox.com/security/data/cve/CVE-2026-34182.md) | High | CMS AuthEnvelopedData Processing May Accept Forged Messages | 9.1 | 0.0106 |  |
| [CVE-2026-34183](https://patchblox.com/security/data/cve/CVE-2026-34183.md) | High | Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler | 9.1 | 0.0105 |  |
| [CVE-2026-34180](https://patchblox.com/security/data/cve/CVE-2026-34180.md) | High | Heap Buffer Over-read in ASN.1 Content Parsing | 9.1 | 0.0103 |  |
| [CVE-2026-7383](https://patchblox.com/security/data/cve/CVE-2026-7383.md) | High | Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion | 9.1 | 0.0080 |  |
| [CVE-2026-42768](https://patchblox.com/security/data/cve/CVE-2026-42768.md) | High | Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() | 9.1 | 0.0080 |  |
| [CVE-2026-9076](https://patchblox.com/security/data/cve/CVE-2026-9076.md) | High | Out-of-Bounds Read in CMS Password-Based Decryption | 9.1 | 0.0071 |  |
| [CVE-2026-45445](https://patchblox.com/security/data/cve/CVE-2026-45445.md) | High | AES-OCB IV Ignored on EVP_Cipher() Path | 9.1 | 0.0070 |  |
| [CVE-2026-42767](https://patchblox.com/security/data/cve/CVE-2026-42767.md) | High | NULL Pointer Dereference in CRMF EncryptedValue Decryption | 9.1 | 0.0056 |  |
| [CVE-2026-42769](https://patchblox.com/security/data/cve/CVE-2026-42769.md) | High | openssl: Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate M... | 9.1 | 0.0054 |  |
| [CVE-2026-42770](https://patchblox.com/security/data/cve/CVE-2026-42770.md) | High | openssl: Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly ch... | 9.1 | 0.0050 |  |
| [CVE-2026-45446](https://patchblox.com/security/data/cve/CVE-2026-45446.md) | High | Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes | 9.1 | 0.0044 |  |
| [CVE-2026-34181](https://patchblox.com/security/data/cve/CVE-2026-34181.md) | High | PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys | 9.1 | 0.0038 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo