Vulnerability details
CVE-2025-15467
OpenSSL OpenSSLRed Hat OpenShift Container Platform 4Siemens AI Lightweight Inference ServerSiemens Connector for AzureSiemens DatabusSiemens Desigo CC family V7
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
CVSS 3.1
9.8Critical
Official description
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.0.0 ≤ v < 3.0.19 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.3.0 ≤ v < 3.3.6 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.4.0 ≤ v < 3.4.4 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.5.0 ≤ v < 3.5.5 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.6.0 ≤ v < 3.6.1 | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | AI Lightweight Inference Server | All | CVEProject cvelistV5 (CNA) |
| Siemens | Connector for Azure | v < V1.8.0 | CVEProject cvelistV5 (CNA) |
| Siemens | Databus | v < V3.3.2 | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V7 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V9 | v < V9.0 QU1 | CVEProject cvelistV5 (CNA) |
| Siemens | HiMed Cockpit | All | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM RM1224 LTE(4G) EU | All | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM RM1224 LTE(4G) NAM | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9403 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9413 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9433 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M804PB | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M812-1 ADSL-Router family | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M816-1 ADSL-Router family | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M826-2 SHDSL-Router | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-3 3G-Router (CN) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-3 (ROK) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 (EU) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 (NAM) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUB852-1 (A1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUB852-1 (B1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (A1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (B1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (EU) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (A1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (B1) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (CN) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (EU) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (RoW) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE S615 EEC LAN-Router | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE S615 LAN-Router | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAB762-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 (ME) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 (US) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 (ME) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 (US) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC (ME) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC (US) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUB762-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUB762-1 iFeatures | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 (US) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 (US) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 (ME) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 (USA) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC316-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC324-4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC324-4 EEC | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC332 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC416-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC424-4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC432 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 EEC | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIDIS Prime | V4.0.700 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC BX-21A | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC MD-57A | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC ORCLA | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IoT2050 Advanced | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Logon V1.6 | v < V1.6 Upd12 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Logon V2.0 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV530 H | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV530 S | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 H | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 H CRANES | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 S | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV550 H | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV550 S | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV560 U | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV560 X | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC PCS neo V6.0 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC PDM V9.3 | v < V9.3 SP2 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC STEP 7 V5 | v < V5.7 SP4 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Target | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.19 | v < V3.19 P024 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.20 | v < V3.20 P012 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.21 | v < V3.21 P02 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC Runtime Advanced V17 | v < V17 Update 9 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC Unified Sequence | v < V21 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V7.5 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V8.0 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V8.1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC eaSie Core Package | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC eaSie PCS 7 Skill Package | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOTION OACAMGEN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.1 | v < V3.1.13 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.2 | v < V3.2.4 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.3 | v < V3.3.2 | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS G200 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS G220 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S200 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S210 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S220 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC INS | v < V1.0 SP2 Update 5 | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC NMS | All | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC Security Monitor | All | CVEProject cvelistV5 (CNA) |
| Siemens | SINUMERIK Access MyMachine /OPC UA | v < V4.2 SP3 | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLANT | All | CVEProject cvelistV5 (CNA) |
| Siemens | SITRANS ASM IQ | All | CVEProject cvelistV5 (CNA) |
| Siemens | SITRANS Soft Sensor Engine IQ (SITRANS SSE IQ) | All | CVEProject cvelistV5 (CNA) |
| Siemens | Shopfloor IT Suite | All | CVEProject cvelistV5 (CNA) |
| Siemens | Siemens OPC UA Modelling Editor (SiOME) | All | CVEProject cvelistV5 (CNA) |
| Siemens | User Management Component (UMC) | v < V2.15.3.0 | CVEProject cvelistV5 (CNA) |
| Siemens | Visual Inspection Cockpit | All | CVEProject cvelistV5 (CNA) |
References and advisories
40- https://openssl-library.org/news/secadv/20260127.txt vendor-advisory
- https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703 patch
- https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc patch
- https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3 patch
- https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9 patch
- https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e patch
- http://www.openwall.com/lists/oss-security/2026/01/27/10
- http://www.openwall.com/lists/oss-security/2026/02/25/6
- https://github.com/guiimoraes/CVE-2025-15467 exploit
- https://cert-portal.siemens.com/productcert/html/ssa-434797.html
- https://cert-portal.siemens.com/productcert/html/ssa-734552.html
- https://access.redhat.com/security/cve/CVE-2025-15467 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2430376 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3415 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2974 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4419 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2659 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2671 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2072 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2633 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2077 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6481 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1496 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1472 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1733 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1594 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1519 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1503 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1473 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3228 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3461 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3462 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1736 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7261 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2485 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2995 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2844 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4943 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2563 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-27
- Last updated
- 2026-10-15
- State
- Published
- Assigner (CNA)
- openssl
Exploit prediction (EPSS)
74.79%
Probability of exploitation in 30 days
99.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-787Out-of-bounds Write
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')