Stackurity Start free trial

CVEs / CVE-2025-15467

CVE-2025-15467: OpenSSL OpenSSL vulnerability

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-15467

Description

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

The CVE record, via NVD · published 27 Jan 2026 · NVD status: Modified

Affected and fixed versions

As stated by the CVE record (from the CNA)
ProductAffectedFixed in
OpenSSL OpenSSLfrom 3.6.0, before 3.6.13.6.1
OpenSSL OpenSSLfrom 3.5.0, before 3.5.53.5.5
OpenSSL OpenSSLfrom 3.4.0, before 3.4.43.4.4
OpenSSL OpenSSLfrom 3.3.0, before 3.3.63.3.6
OpenSSL OpenSSLfrom 3.0.0, before 3.0.193.0.19
Siemens AI Lightweight Inference Serverall versions—
Siemens Connector for Azurebefore V1.8.0V1.8.0
Siemens Databusbefore V3.3.2V3.3.2
Siemens Desigo CC family V7all versions—
Siemens Desigo CC family V8all versions—
Siemens Desigo CC family V9before V9.0 QU1V9.0 QU1
Siemens HiMed Cockpitall versions—
Siemens RUGGEDCOM RM1224 LTE(4G) EUall versions—
Siemens RUGGEDCOM RM1224 LTE(4G) NAMall versions—
Siemens SCALANCE LPE9403all versions—
Siemens SCALANCE LPE9413all versions—
Siemens SCALANCE LPE9433all versions—
Siemens SCALANCE M804PBall versions—
Siemens SCALANCE M812-1 ADSL-Router familyall versions—
Siemens SCALANCE M816-1 ADSL-Router familyall versions—
Siemens SCALANCE M826-2 SHDSL-Routerall versions—
Siemens SCALANCE M874-2all versions—
Siemens SCALANCE M874-3all versions—
Siemens SCALANCE M874-3 3G-Router (CN)all versions—
Siemens SCALANCE M876-3all versions—
Siemens SCALANCE M876-3 (ROK)all versions—
Siemens SCALANCE M876-4all versions—
Siemens SCALANCE M876-4 (EU)all versions—
Siemens SCALANCE M876-4 (NAM)all versions—
Siemens SCALANCE MUB852-1 (A1)all versions—

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

Severity

CVSS 3.18.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Scored by the CNA (134c704f-9b21-4f2e-91b3-4a467353bcc0)
WeaknessCWE-787, CWE-120

References

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.