The vulnerability CVE-2026-45445 concerns the AES-OCB encryption mode implementation in Microsoft-related cryptographic libraries, specifically when using the EVP_Cipher() function. The flaw causes the Initialization Vector (IV) to be ignored, which can undermine the cryptographic strength and potentially lead to weakened encryption guarantees. This is classified under CWE-325, indicating improper use of cryptographic primitives. The advisory does not provide patch or mitigation details, nor does it confirm exploitation in the wild. Affected products include Microsoft software and OpenSSL components, with mentions of Azure Linux 3.0, but no precise version ranges are specified.

Ignoring the Initialization Vector (IV) in AES-OCB mode compromises the intended cryptographic protections, potentially allowing attackers to predict or manipulate encrypted data. This weakens the confidentiality and integrity assurances of the encryption process. However, no known exploits have been reported, and the exact impact depends on how the affected cryptographic functions are used within applications.

Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. No official fix or workaround information is provided at this time. Users should monitor vendor communications for updates and apply patches once available.