Request: MIP SDK release built against OpenSSL 3.5.9+ (1.18.148 bundles OpenSSL 3.5.7 with known CVEs)

REQUEST

Please publish a MIP SDK release built against OpenSSL 3.5.9 or later, and let

us know a target date.

PROBLEM

We ship the MIP SDK in a commercial enterprise product. The OpenSSL libraries

bundled with the SDK are affected by published CVEs, and your latest release

does not resolve them:

MIP SDK 1.18.124 -> bundles OpenSSL 3.4.4 (released 27 Jan 2026)

MIP SDK 1.18.148 -> bundles OpenSSL 3.5.7 (released 9 Jun 2026)

We determined the bundled versions by calling OpenSSL_version(OPENSSL_VERSION),

a public OpenSSL API, on the libraries shipped in your Windows NuGet packages

and macOS zip.

OpenSSL 3.5.8 (25 Aug 2026) and 3.5.9 (29 Sep 2026) fix 10 CVEs that 3.5.7 does

not contain:

CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,

CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075,

CVE-2026-63076, CVE-2026-75803

The CVE escalated to us by a customer is CVE-2026-14457, fixed in OpenSSL 3.5.8.

Per your published version release history, 1.18.148 was released on

4 Sep 2026 - ten days after OpenSSL 3.5.8 became available - so the fixed

OpenSSL could have been included.

Affected files: libcrypto-3-x64.dll, libcrypto-3-arm64.dll, libcrypto-3.dll,

libssl-3-x64.dll, libssl-3-arm64.dll, libssl-3.dll, libcrypto.3.dylib,

libssl.3.dylib (Windows x64/arm64/x86, macOS arm64/x86_64).

ENVIRONMENT

MIP SDK 1.18.124 and 1.18.148; packages Microsoft.InformationProtection.File,

.Policy, .Protection (NuGet) and mip_sdk_file_macos_1.18.148.zip;

Windows x64/arm64/x86, macOS arm64/x86_64.