The OpenSSL Project has disclosed a high-severity vulnerability in multiple versions of the widely used cryptography library, exposing systems to potential remote code execution attacks.
The flaw, identified as CVE-2025-15467, stems from a stack buffer overflow in CMS AuthEnvelopedData parsing when processing maliciously crafted AEAD parameters.
Critical Stack Buffer Overflow in CMS Implementation
The vulnerability affects the Cryptographic Message Syntax (CMS) AuthEnvelopedData structure handling within OpenSSL’s cryptographic framework.
When parsing CMS messages that utilize Authenticated Encryption with Associated Data (AEAD) ciphers such as AES-GCM, the Initialization Vector encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without proper bounds checking.
This oversight allows attackers to supply a crafted CMS message containing an oversized IV, triggering a stack-based out-of-bounds write operation before any authentication or tag verification occurs.
The attack vector is particularly concerning because the overflow happens prior to authentication checks, eliminating the need for valid key material to exploit the vulnerability.
Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers including S/MIME AuthEnvelopedData implementations with AES-GCM are at risk.
Stack buffer overflow vulnerabilities can corrupt adjacent data on the call stack, potentially allowing attackers to overwrite return addresses and redirect program execution to malicious code.
Affected Versions and Remediation
OpenSSL versions 3.0 through 3.6 are vulnerable to this issue, while legacy versions 1.1.1 and 1.0.2 remain unaffected.
The FIPS modules across all affected branches are not impacted since the CMS implementation exists outside the OpenSSL FIPS module boundary.
Security researcher Stanislav Fort from Aisle Research reported the vulnerability on December 14, 2025, with the fix developed by Igor Ustinov.
| CVE ID | Severity | CVSS Score | Affected Versions | Patched Versions |
|---|---|---|---|---|
| CVE-2025-15467 | High | N/A | 3.0, 3.3, 3.4, 3.5, 3.6 | 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1 |
Users should immediately upgrade to patched versions to mitigate exploitation risks.
OpenSSL 3.6 users must upgrade to version 3.6.1, while 3.5 users should deploy version 3.5.5. Version 3.4 requires an upgrade to 3.4.4, version 3.3 to 3.3.6, and version 3.0 to 3.0.19.
While exploitability to achieve remote code execution depends on platform-specific factors and compiler toolchain mitigations, the stack-based write primitive represents a severe security risk that demands immediate remediation.
Organizations using OpenSSL for secure communications, particularly those implementing S/MIME email encryption or processing untrusted cryptographic messages, should prioritize patching affected systems.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
