The update for OpenSSL 3 fixes several vulnerabilities: CVE-2024-41996 allows remote attackers to trigger expensive server-side Diffie-Hellman computations by manipulating public key order; CVE-2026-7383 is a possible heap buffer overflow in ASN.1 multibyte string conversion; CVE-2026-9076 is an out-of-bounds read in CMS password-based decryption; CVE-2026-28390 involves a null pointer dereference during processing of crafted CMS EnvelopedData messages; CVE-2026-34180 is a heap buffer over-read in ASN.1 content parsing; CVE-2026-34182 allows acceptance of forged CMS AuthEnvelopedData messages; CVE-2026-42766 is a possible null dereference in password-based CMS decryption; CVE-2026-42770 involves FFC-DH peer validation using attacker-supplied parameters; CVE-2026-45445 and CVE-2026-45446 relate to incorrect IV and tag processing in AES-OCB and AES-GCM-SIV/AES-SIV modes; CVE-2026-45447 is a heap use-after-free in PKCS7_verify(). These vulnerabilities collectively impact cryptographic operations and message processing in OpenSSL 3.

The vulnerabilities can lead to denial-of-service conditions via resource exhaustion, memory corruption including heap buffer overflows and use-after-free, out-of-bounds memory reads, null pointer dereferences causing crashes, acceptance of forged cryptographic messages, and incorrect cryptographic processing potentially undermining message confidentiality and integrity. These issues affect the security and stability of applications relying on OpenSSL 3 for cryptographic functions.

A security update for OpenSSL 3 has been released addressing these vulnerabilities. Users should apply the official OpenSSL 3 update provided by their vendor or distribution to remediate these issues. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance and apply updates accordingly.