CVE-2025-9230 Out-of-bounds read & write in RFC 3211 KEK Unwrap
An out-of-bounds read and write in OpenSSL's CMS password-based encryption allows attackers to cause crashes or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9230?
CVE-2025-9230 is a high-severity memory corruption vulnerability in OpenSSL, published on 30 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.
Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
Which versions are affected by CVE-2025-9230?
Linux distribution packages (40)
openssl AlmaLinux:10 | All versions | 1:3.5.1-4.el10_1.alma.1 |
openssl-devel AlmaLinux:10 | All versions | 1:3.5.1-4.el10_1.alma.1 |
openssl-libs AlmaLinux:10 | All versions | 1:3.5.1-4.el10_1.alma.1 |
openssl-perl AlmaLinux:10 | All versions | 1:3.5.1-4.el10_1.alma.1 |
edk2-aarch64 AlmaLinux:8 | All versions | 20220126gitbb1bba3d77-13.el8_10.10 |
edk2-ovmf AlmaLinux:8 | All versions | 20220126gitbb1bba3d77-13.el8_10.10 |
openssl AlmaLinux:8 | All versions | 1:1.1.1k-14.el8_10 |
openssl-devel AlmaLinux:8 | All versions | 1:1.1.1k-14.el8_10 |
openssl-libs AlmaLinux:8 | All versions | 1:1.1.1k-14.el8_10 |
openssl-perl AlmaLinux:8 | All versions | 1:1.1.1k-14.el8_10 |
edk2-aarch64 AlmaLinux:9 | All versions | 20241117-4.el9_7.3 |
edk2-ovmf AlmaLinux:9 | All versions | 20241117-4.el9_7.3 |
edk2-tools AlmaLinux:9 | All versions | 20241117-4.el9_7.3 |
edk2-tools-doc AlmaLinux:9 | All versions | 20241117-4.el9_7.3 |
openssl AlmaLinux:9 | All versions | 1:3.5.1-4.el9_7 |
openssl-devel AlmaLinux:9 | All versions | 1:3.5.1-4.el9_7 |
openssl-libs AlmaLinux:9 | All versions | 1:3.5.1-4.el9_7 |
openssl-perl AlmaLinux:9 | All versions | 1:3.5.1-4.el9_7 |
openssl Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-debugsource Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-devel Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-libs Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-libs-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
openssl-perl Red Hat:enterprise_linux:10.1 | All versions | 1:3.5.1-4.el10_1 |
edk2 Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-aarch64 Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-ovmf Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-tools Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-tools-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2-tools-doc Red Hat:enterprise_linux:10.2 | All versions | 0:20250822-4.el10 |
edk2 Red Hat:enterprise_linux:8::appstream | All versions | 0:20220126gitbb1bba3d77-13.el8_10.10 |
edk2-aarch64 Red Hat:enterprise_linux:8::appstream | All versions | 0:20220126gitbb1bba3d77-13.el8_10.10 |
edk2-ovmf Red Hat:enterprise_linux:8::appstream | All versions | 0:20220126gitbb1bba3d77-13.el8_10.10 |
openssl Red Hat:enterprise_linux:8::baseos | All versions | 1:1.1.1k-14.el8_10 |
openssl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 1:1.1.1k-14.el8_10 |
openssl-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 1:1.1.1k-14.el8_10 |
openssl-devel Red Hat:enterprise_linux:8::baseos | All versions | 1:1.1.1k-14.el8_10 |
openssl-libs Red Hat:enterprise_linux:8::baseos | All versions | 1:1.1.1k-14.el8_10 |
How do I fix CVE-2025-9230?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9230 being exploited?
There is no known exploitation of CVE-2025-9230 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-9230, ALSA-2025:21248, ALSA-2025:21255, ALSA-2026:0337, ALSA-2026:2776, ALSA-2026:36721 and 82 more.