High-Severity Remote Code Execution Vulnerability Patched in OpenSSL

OpenSSL released updates that patch twelve vulnerabilities identified by cybersecurity firm Aisle using an autonomous analyzer. The most severe issue, CVE-2025-15467, is a stack buffer overflow in CMS AuthEnvelopedData parsing when AEAD ciphers like AES-GCM are used; an oversized IV in ASN.1 parameters is copied into a fixed-size stack buffer, enabling a stack-based out-of-bounds write before authentication. Attackers can trigger the overflow without valid key material, and remote code execution depends on platform and toolchain mitigations. The releases also fix CVE-2025-11187 (moderate), several low-severity DoS and information-exposure flaws, and six issues addressed prior to release.

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable."

"OpenSSL updates released on Tuesday patch a dozen vulnerabilities, including a high-severity remote code execution flaw. All 12 vulnerabilities patched in the open source SSL/TLS toolkit were discovered by cybersecurity firm Aisle, which used an autonomous analyzer to identify the security holes. The high-severity issue is tracked as CVE-2025-15467 and it has been described as a stack buffer overflow that could lead to a crash (DoS condition) or remote code execution in certain conditions."

Read at SecurityWeek