CVE-2025-55117 BMC Control-M/Agent buffer overflow in SSL/TLS communication

Medium 6.3 Published 16 Sep 2025 Updated 16 Sep 2025

Remote attackers can trigger a stack-based buffer overflow in BMC Control-M/Agent during SSL/TLS communication, potentially leading to code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-55117?

CVE-2025-55117 is a medium-severity memory corruption vulnerability in BMC Control-M/Agent, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured.

The issue occurs in the following cases:

* Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n".

Weakness: CWE-121

Which versions are affected by CVE-2025-55117?

It affects 1 product.

Products include Bmc Control-M\/Agent.

How do I fix CVE-2025-55117?

No fix has been published for CVE-2025-55117 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-55117 being exploited?

There is no known exploitation of CVE-2025-55117 in the wild and no public exploit code.

Sources

Also known as GHSA-2227-jcpx-8w3r.