Junglewise Threat Intelligence

CVE-2025-15467: OpenSSL stack buffer overflow in CMS AEAD parameter parsing

CVE-2025-15467 · Severity: high · CVSS 8.8 · Published 2026-01-27

Technologies: OpenSSL Foundation OpenSSL. Vendors: ABB.

Executive brief

OpenSSL, a widely used security library for encrypting internet communications, contains a vulnerability in how it handles certain encrypted messages. An attacker can send a specially crafted message that causes the software to crash or potentially allow the attacker to take control of the system. This issue occurs before the software even verifies the sender's identity, making it a significant risk for any service that processes encrypted emails or files using OpenSSL.

Technical details

A stack-based buffer overflow exists in OpenSSL's Cryptographic Message Syntax (CMS) implementation. The vulnerability is located in the 'evp_cipher_get_asn1_aead_params' function within 'crypto/evp/evp_lib.c', where an Initialization Vector (IV) from ASN.1 parameters is copied into a fixed-size stack buffer without adequate length validation. An attacker can trigger this by providing a crafted CMS AuthEnvelopedData or EnvelopedData message using AEAD ciphers like AES-GCM. Because the overflow occurs during parameter parsing before authentication or tag verification, no valid cryptographic keys are required. This can lead to a denial-of-service (crash) or remote code execution. Patches are available in OpenSSL versions 3.0.19, 3.3.6, 3.4.4, 3.5.5, and 3.6.1.

Affected products

  • OpenSSL Foundation OpenSSL 3.0.0 to 3.0.18, 3.1.0 to 3.3.5, 3.4.0 to 3.4.3, 3.5.0 to 3.5.4, 3.6.0 to 3.6.0

Timeline

  • 2026-01-26: patched: Fixes committed to OpenSSL repository
  • 2026-01-27: advisory: OpenSSL Security Advisory published

References