Skip to content
Fencer Vulns
critical 9.8

CVE-2025-15467 in the critical feed json

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

published 2026-01-27 9 mo ago modified 2026-10-15 25 d ago also EUVD-2025-206379 , GHSA-wvhq-3h88-rf6g , JLSEC-2026-256

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
74.8%
EPSS 74.8% chance of exploitation in 30 days, percentile 99.5%
public exploits
0
none known

Summary

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.

Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution.

When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Patch / fix

  • julia OpenSSL_jll 3.0.20+0, 3.5.5+0
  • julia Openresty_jll 1.29.203+0
  • OpenSSL OpenSSL 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
  • Siemens Connector for Azure V1.8.0
  • Siemens Databus V3.3.2
  • Siemens Desigo CC family V9 V9.0 QU1
  • openssl Debian 12 3.0.18-1~deb12u2
  • openssl Debian 13 3.5.4-1~deb13u2
  • openssl Debian 14 3.5.5-1

debian advisories DEBIAN-CVE-2025-15467

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.21
  • openssl Ubuntu 24.04 LTS 3.0.13-0ubuntu3.7
  • openssl Ubuntu 25.10 3.5.3-1ubuntu3
  • openssl Ubuntu 26.04 LTS 3.5.5-1ubuntu1
  • openssl Ubuntu Pro FIPS-updates 22.04 LTS 3.0.2-0ubuntu1.21+Fips1
  • openssl-fips Ubuntu Pro FIPS-updates 24.04 LTS 3.0.13-0ubuntu3.12+Fips1

ubuntu advisories UBUNTU-CVE-2025-15467

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl hummingbird 1 3.5.6-0.1.hum1
  • openssl-libs hummingbird 1 3.5.6-0.1.hum1
  • openssl-perl hummingbird 1 3.5.6-0.1.hum1
  • openssl-config-fips hummingbird 1 3.5.6-0.1.hum1
  • openssl-devel-engine hummingbird 1 3.5.6-0.1.hum1
  • openssl RHEL 9 1:3.5.1-7.el9_7
  • openssl-libs RHEL 9 1:3.5.1-7.el9_7
  • openssl-perl RHEL 9 1:3.5.1-7.el9_7

red hat advisories RHSA-2026:7261RHSA-2026:1733RHSA-2026:1594RHSA-2026:1519RHSA-2026:1503RHSA-2026:1496

  • openssl-3-livepatches Linux Micro 6.1 0.4-slfo.1.1_1.1
  • openssl-3-livepatches SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 0.3-160000.1.1
  • openssl-3 Linux Micro 6.1 3.1.4-slfo.1.1_8.1
  • openssl-3 Linux Micro 6.0 3.1.4-11.1
  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.5.1
  • openssl-3 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 3.1.4-150600.5.42.1
  • openssl-3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 3.0.8-150500.5.57.1
  • openssl-3 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 3.0.8-150400.4.78.1

suse advisories SUSE-SU-2026:2662-1SUSE-SU-2026:2411-1SUSE-SU-2026:22143-1SUSE-SU-2026:20542-1SUSE-SU-2026:20607-1SUSE-SU-2026:20373-1

  • openssl-3 openSUSE Tumbleweed 3.5.3-2.1
  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.5.1

opensuse advisories openSUSE-SU-2026:10237-1openSUSE-SU-2026:20152-1

  • openssl AlmaLinux 10 1:3.5.1-7.el10_1.alma.1
  • openssl-libs AlmaLinux 10 1:3.5.1-7.el10_1.alma.1
  • openssl-perl AlmaLinux 10 1:3.5.1-7.el10_1.alma.1
  • openssl AlmaLinux 9 1:3.5.1-7.el9_7
  • openssl-libs AlmaLinux 9 1:3.5.1-7.el9_7
  • openssl-perl AlmaLinux 9 1:3.5.1-7.el9_7

almalinux advisories ALSA-2026:1472ALSA-2026:1473

  • openssl Rocky Linux 10 1:3.5.1-7.el10_1
  • openssl Rocky Linux 9 1:3.5.1-7.el9_7

rocky linux advisories RLSA-2026:1472RLSA-2026:1473

  • openssl Alpine 3.17 3.0.19-r0
  • openssl Alpine 3.21, Alpine 3.20 3.3.6-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 3.5.5-r0

alpine advisories ALPINE-CVE-2025-15467

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Azure Linux 3.0 3.3.5-3
  • edk2 Azure Linux 3.0 20240524git3e722403cd16-14

azure linux advisories AZL-75791AZL-75908

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-15467 updated cvss 9.8

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cost Management 4 costmanagement 1770836349
    fixed: vendor fix RHSA-2026:3228
  • Red Hat AI Inference Server 3.2 rhaiis 1772160593, rhaiis 1772160625
    fixed: vendor fix RHSA-2026:3461
  • Red Hat Discovery 2 discovery 1769104765, discovery 1769111774
    fixed: vendor fix RHSA-2026:1736
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.5.1-7.el9_7
    fixed: vendor fix RHSA-2026:1473
  • Red Hat Enterprise Linux AppStream (v. 10) openssl-perl 3.5.1-7.el10_1
    fixed: vendor fix RHSA-2026:1472
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) openssl-perl 3.0.1-46.el9_0.7
    fixed: vendor fix RHSA-2026:1733
show 26 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) openssl-perl 3.0.7-18.el9_2.3
    fixed: vendor fix RHSA-2026:1594
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) openssl-perl 3.2.2-16.el10_0.6
    fixed: vendor fix RHSA-2026:1496
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) openssl-perl 3.0.7-29.el9_4.2
    fixed: vendor fix RHSA-2026:1519
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) openssl-perl 3.2.2-7.el9_6.2
    fixed: vendor fix RHSA-2026:1503
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.5.1-7.el9_7, openssl-libs 3.5.1-7.el9_7
    fixed: vendor fix RHSA-2026:1473
  • Red Hat Enterprise Linux BaseOS (v. 10) openssl 3.5.1-7.el10_1, openssl-libs 3.5.1-7.el10_1
    fixed: vendor fix RHSA-2026:1472
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) openssl 3.0.1-46.el9_0.7, openssl-libs 3.0.1-46.el9_0.7
    fixed: vendor fix RHSA-2026:1733
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssl 3.0.7-18.el9_2.3, openssl-libs 3.0.7-18.el9_2.3
    fixed: vendor fix RHSA-2026:1594
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssl 3.2.2-16.el10_0.6, openssl-libs 3.2.2-16.el10_0.6
    fixed: vendor fix RHSA-2026:1496
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) openssl 3.0.7-29.el9_4.2, openssl-libs 3.0.7-29.el9_4.2
    fixed: vendor fix RHSA-2026:1519
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) openssl 3.2.2-7.el9_6.2, openssl-libs 3.2.2-7.el9_6.2
    fixed: vendor fix RHSA-2026:1503
  • Red Hat Hardened Images openssl 3.5.6-0.1.hum1, openssl-libs 3.5.6-0.1.hum1, openssl-perl 3.5.6-0.1.hum1, openssl-config-fips 3.5.6-0.1.hum1, openssl-devel-engine 3.5.6-0.1.hum1
    fixed: vendor fix RHSA-2026:7261
  • Red Hat Insights proxy 1.5 insights-proxy 1770740405
    fixed: vendor fix RHSA-2026:2485
  • Red Hat JBoss Core Services 2.4.62.SP3
    fixed: vendor fix RHSA-2026:2995
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202602240113
    fixed: vendor fix RHSA-2026:3415
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202602171627
    fixed: vendor fix RHSA-2026:2974
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202603101737
    fixed: vendor fix RHSA-2026:4419
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202602101357
    fixed: vendor fix RHSA-2026:2659
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202602090846
    fixed: vendor fix RHSA-2026:2671
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202602022246
    fixed: vendor fix RHSA-2026:2072
  • Red Hat OpenShift Container Platform 4.19 rhcos 9.6.20260211, rhcos 4.19.9.6.202602112047
    fixed: vendor fix RHSA-2026:2633
  • Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202602050328
    fixed: vendor fix RHSA-2026:2077
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 devspaces 1770404430, devspaces 1770404517, devspaces 1770404535, devspaces 1770494431, devspaces 1770494649, devspaces 1770494726, +4 more
    fixed: vendor fix RHSA-2026:2844
  • Red Hat Service Interconnect 1 service-interconnect/skupper-router-rhel9 2.7.6-5, service-interconnect/skupper-operator-bundle 1.8.8-1, service-interconnect/skupper-config-sync-rhel9 1.8.8-1, service-interconnect/skupper-flow-collector-rhel9 1.8.8-1, service-interconnect/skupper-site-controller-rhel9 1.8.8-1, service-interconnect/skupper-controller-podman-rhel9 1.8.8-1, +2 more
    fixed: vendor fix RHSA-2026:6481
  • Red Hat Update Infrastructure 5 rhui5 1770646925, rhui5 1773670073, rhui5 1773670137, rhui5 1773672059
    fixed: vendor fix RHSA-2026:4943
  • Red Hat Cost Management 4 costmanagement 1770837277 Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl-libs, openssl-perl Red Hat Enterprise Linux 8 edk2, shim, openssl, shim-x64, edk2-ovmf, shim-aa64, +9 more Red Hat Enterprise Linux 9 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, edk2-tools, +4 more Red Hat Enterprise Linux 10 edk2, shim, shim-unsigned-x64, shim-unsigned-aarch64
    +1 more products
    Red Hat Enterprise Linux AppStream E4S (v.9.0) openssl-debuginfo 3.0.1-46.el9_0.7, openssl-debugsource 3.0.1-46.el9_0.7, openssl-libs-debuginfo 3.0.1-46.el9_0.7
    not affected: vulnerable code not present

11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-174-03 updated cvss 8.8

Siemens Products using OpenSSL

  • Siemens AI Lightweight Inference Server
    affected: mitigation, no fix planned
  • Siemens Connector for Azure < 1.8.0
    affected: fixed in V1.8.0, mitigation docs.eu1.edge.siemens.cloud
  • Siemens Databus < 3.3.2
    affected: fixed in V3.3.2, mitigation docs.eu1.edge.siemens.cloud
  • Siemens HiMed Cockpit Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2)
    affected: mitigation, no fix available
  • Siemens SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Siemens SCALANCE LPE9433 (6GK5998-3GS11-2AC2)
    affected: mitigation, no fix planned
  • Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) Siemens SCALANCE M812-1 ADSL-Router family Siemens SCALANCE M816-1 ADSL-Router family Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2)
    +25 more products
    Siemens SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2) Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) Siemens SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) Siemens SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) Siemens SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) Siemens SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) Siemens SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) Siemens SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) Siemens SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) Siemens SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) Siemens SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)
    affected: mitigation, no fix available

99 more affected, 145 more not affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-209-01 updated cvss 9.8

Siemens Desigo CC

  • Siemens Desigo CC family V7
    affected: no fix available
  • Siemens Desigo CC family V8
    affected: vendor fix
  • Siemens Desigo CC family V9 < 9.0.1
    affected: fixed in V9.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-132-05 updated cvss 9.8

ABB AC500 V3 Stack Buffer Overflow in Cryptographic Message Syntax

  • ABB AC500 V3 AC500 V3 Firmware 3.9.0
    affected: vendor fix, workaround, mitigation
  • ABB AC500 V3 AC500 V3 Firmware 3.9.0_HF1
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
7 mo ago

Exploit prediction

74.79% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/guiimoraes/CVE-2025-15467 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia OpenSSL_jll
>=3.0.8+0, <3.0.20+0
>=3.5.0+0, <3.5.5+0
3.0.20+0
3.5.5+0
julia Openresty_jll
>=1.27.1+0, <1.29.203+0
1.29.203+0

Affected products

  • OpenSSL OpenSSL
  • Siemens AI Lightweight Inference Server
  • Siemens Connector for Azure
  • Siemens Databus
  • Siemens Desigo CC family V7
  • Siemens Desigo CC family V8
  • Siemens Desigo CC family V9
  • Siemens HiMed Cockpit
  • Siemens RUGGEDCOM RM1224 LTE(4G) EU
  • Siemens RUGGEDCOM RM1224 LTE(4G) NAM
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000
  • Siemens SCALANCE LPE9403
  • Siemens SCALANCE LPE9413
  • Siemens SCALANCE LPE9433
  • Siemens SCALANCE M804PB
  • Siemens SCALANCE M812-1 ADSL-Router family
  • Siemens SCALANCE M816-1 ADSL-Router family
  • Siemens SCALANCE M826-2 SHDSL-Router
  • Siemens SCALANCE M874-2
  • Siemens SCALANCE M874-3
  • Siemens SCALANCE M874-3 3G-Router (CN)
  • Siemens SCALANCE M876-3
  • Siemens SCALANCE M876-3 (ROK)
  • Siemens SCALANCE M876-4
  • Siemens SCALANCE M876-4 (EU)
  • Siemens SCALANCE M876-4 (NAM)
  • Siemens SCALANCE MUB852-1 (A1)
  • Siemens SCALANCE MUB852-1 (B1)
  • Siemens SCALANCE MUM853-1 (A1)
  • Siemens SCALANCE MUM853-1 (B1)
  • Siemens SCALANCE MUM853-1 (EU)
  • Siemens SCALANCE MUM856-1 (A1)
  • Siemens SCALANCE MUM856-1 (B1)
  • Siemens SCALANCE MUM856-1 (CN)
  • Siemens SCALANCE MUM856-1 (EU)
  • Siemens SCALANCE MUM856-1 (RoW)
  • Siemens SCALANCE S615 EEC LAN-Router
  • Siemens SCALANCE S615 LAN-Router
  • Siemens SCALANCE SC622-2C
  • Siemens SCALANCE SC626-2C

Classification

Weakness
  • CWE-787 Out-of-bounds Write
  • CWE-120 Buffer Copy without Checking Size of Input
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.