--- id: CVE-2025-15467 title: |- Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, … summary: |- Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, … severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-787 - CWE-120 vendor: openssl product: openssl affected: - 'openssl >= 3.0.0, < 3.0.19' - 'openssl >= 3.1.0, < 3.3.6' - 'openssl >= 3.4.0, < 3.4.4' - 'openssl >= 3.5.0, < 3.5.5' - 'openssl >= 3.6.0, < 3.6.1' patched: - openssl 3.6.1 published: '2026-01-27' updated: '2026-06-30' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15467' references: - url: >- https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3 label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc label: openssl-security@openssl.org - url: 'https://openssl-library.org/news/secadv/20260127.txt' label: openssl-security@openssl.org - url: 'http://www.openwall.com/lists/oss-security/2026/01/27/10' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2026/02/25/6' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:1472' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1473' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1496' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1503' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1519' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1594' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1733' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1736' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2072' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2077' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2485' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2563' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2633' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2659' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2671' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2844' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2974' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:2995' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3228' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3415' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3461' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3462' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4419' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4943' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6481' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:7261' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2025-15467' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2430376' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://cert-portal.siemens.com/productcert/html/ssa-434797.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://github.com/guiimoraes/CVE-2025-15467' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2025-15467' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15467' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat epss: 0.48211 epssPercentile: 0.98808 ingestedAt: '2026-06-30T17:40:12.468Z' exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: total timestamp: '2026-03-19T00:00:00+00:00' exploits: github: 5 githubRepos: - 'https://github.com/balgan/CVE-2025-15467' - 'https://github.com/guiimoraes/CVE-2025-15467' - 'https://github.com/mr-r3b00t/CVE-2025-15467' checkedAt: '2026-09-24T07:52:55.374Z' scores: nvd: 8.8 vendor: 9.8 --- ## Overview Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. ## Affected - `openssl >= 3.0.0, < 3.0.19` - `openssl >= 3.1.0, < 3.3.6` - `openssl >= 3.4.0, < 3.4.4` - `openssl >= 3.5.0, < 3.5.5` - `openssl >= 3.6.0, < 3.6.1` ## Remediation Upgrade past the affected range: - `openssl 3.6.1` ## Vendor advisories - **RHSA-2026:3415** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3415) - **RHSA-2026:2974** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-02-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:2974) - **RHSA-2026:4419** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:4419) - **RHSA-2026:2659** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2659) - **RHSA-2026:2671** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2671) - **RHSA-2026:2072** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-02-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:2072) - **RHSA-2026:2633** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2633) - **RHSA-2026:2077** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-02-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:2077) - **RHSA-2026:6481** · Red Hat · fixed in: Red Hat Service Interconnect 1 · released 2026-04-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:6481) - **RHSA-2026:1496** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1496) - **RHSA-2026:1472** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1472) - **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json)