CVE-2025-15467
📋 TL;DR
This vulnerability allows attackers to trigger a stack buffer overflow by sending maliciously crafted CMS AuthEnvelopedData messages with oversized IV parameters. Applications and services parsing untrusted CMS or PKCS#7 content using AEAD ciphers like AES-GCM are vulnerable. The overflow occurs before authentication, requiring no valid key material to trigger.
💻 Affected Systems
- OpenSSL
📦 What is this software?
Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Denial of service through application crashes
If Mitigated
Application crash without code execution if stack protections are enabled
🎯 Exploit Status
No valid key material required to trigger overflow. Exploitability for RCE depends on platform mitigations like ASLR and stack canaries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check OpenSSL security advisories for specific patched versions
Vendor Advisory: https://www.openssl.org/news/secadv/
Restart Required: Yes
Instructions:
1. Check current OpenSSL version
2. Update to patched version via package manager
3. Restart affected services
4. Recompile applications if statically linked
🔧 Temporary Workarounds
Disable CMS AuthEnvelopedData parsing
allConfigure applications to reject or not process CMS AuthEnvelopedData messages
Application-specific configuration required
🧯 If You Can't Patch
- Implement network filtering to block CMS AuthEnvelopedData messages
- Use application-level input validation to reject oversized IV parameters
🔍 How to Verify
Check if Vulnerable:
Check OpenSSL version with 'openssl version' commandCheck Version:
openssl versionVerify Fix Applied:
Verify version is not in affected range (3.0-3.6) or has been patched📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Stack overflow errors
- Memory corruption warnings
Network Indicators:
- CMS AuthEnvelopedData messages with large IV parameters
SIEM Query:
Application logs containing 'segmentation fault', 'stack overflow', or 'buffer overflow' near CMS parsing events🔗 References
- https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703
- https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9
- https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3
- https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e
- https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc
- https://openssl-library.org/news/secadv/20260127.txt
- http://www.openwall.com/lists/oss-security/2026/01/27/10
- http://www.openwall.com/lists/oss-security/2026/02/25/6
