# CVE-2025-15467: Stack buffer overflow in CMS (Auth)EnvelopedData parsing

> Attackers can trigger a stack buffer overflow in OpenSSL by sending crafted CMS messages with oversized IVs, potentially causing crashes or remote code execution.

- **Severity:** High 8.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 27 Jan 2026
- **Updated:** 15 Oct 2026
- **Also known as:** ALPINE-CVE-2025-15467, AZL-75791, AZL-75908, BELL-CVE-2025-15467, CLEANSTART-2026-VU59374, DEBIAN-CVE-2025-15467, ECHO-decb-8594-a95c, GHSA-wvhq-3h88-rf6g, JLSEC-2026-256, MINI-3f28-p62q-7h2x, MINI-mp9j-f499-pfq3, MINI-mxh7-mw93-fg88, OESA-2026-1310, OESA-2026-1311, OESA-2026-1312, OESA-2026-1391, OESA-2026-1392, OESA-2026-1393, OESA-2026-1394, UBUNTU-CVE-2025-15467

## What is CVE-2025-15467?

CVE-2025-15467 is a high-severity memory corruption vulnerability in Openssl Openssl, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.

Impact summary: A stack buffer overflow may lead to a crash, causing Denial
of Service, or potentially remote code execution.

When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as
AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is
copied into a fixed-size stack buffer without verifying that its length fits
the destination. An attacker can supply a crafted CMS message with an
oversized IV, causing a stack-based out-of-bounds write before any
authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using
AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.
Because the overflow occurs prior to authentication, no valid key material
is required to trigger it. While exploitability to remote code execution
depends on platform and toolchain mitigations, the stack-based write
primitive represents a severe risk.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
issue, as the CMS implementation is outside the OpenSSL FIPS module
boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

Weakness: CWE-120 (Buffer Copy without Checking Size of Input), CWE-787 (Out-of-bounds Write)

## Which versions are affected by CVE-2025-15467?

It affects 1 product.


Products: Openssl Openssl.

## How do I fix CVE-2025-15467?

Apply the vendor's patch.

## Is CVE-2025-15467 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15467 exists.

Public exploit code:

- Command Execution PoC for OpenSSL Stack buffer overflow CVE-2025-15467 (github_poc): https://github.com/guiimoraes/CVE-2025-15467
- Working DoS for CVE-2025-15467 and a docker container to test against (github_poc): https://github.com/balgan/CVE-2025-15467
- discovery tool (powershell) (github_poc): https://github.com/mr-r3b00t/CVE-2025-15467
- Exploit script for cve-2025-15467 (github_poc): https://github.com/materaj2/cve-2025-15467
- https://github.com/WostGit/cve-2025-15467-crash (github_poc): https://github.com/WostGit/cve-2025-15467-crash

## Other vulnerabilities in Openssl Openssl

- [CVE-2009-3245](https://insights.sbomify.com/CVE-2009-3245/): Null dereference in n/a (critical 10.0)
- [CVE-2006-3738](https://insights.sbomify.com/CVE-2006-3738/): Memory corruption in n/a (critical 10.0)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2016-6309](https://insights.sbomify.com/CVE-2016-6309/): Use after free in n/a (critical 9.8)
- [CVE-2016-0799](https://insights.sbomify.com/CVE-2016-0799/): Integer overflow in n/a (critical 9.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-15467 and fix it if it is affected.

What it is: CVE-2025-15467 is a high-severity memory corruption vulnerability in Openssl Openssl, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15467 exists.

Affected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-15467/ (Markdown: https://insights.sbomify.com/CVE-2025-15467/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-15467
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-15467
- OSV: https://osv.dev/vulnerability/CVE-2025-15467

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-15467/
Summaries are generated and may contain mistakes; the official description above is the record.