a major security alert that addresses several flaws in various iterations of its cryptographic library This article explores vulnerability openssl uses. . Ten different security vulnerabilities, including memory corruption and logic errors, are fixed by the update.

The most serious of these could cause denial-of-service (DoS) conditions on impacted systems or enable remote attackers to run arbitrary code. The advisory identifies two main vulnerabilities that put software dependencies and enterprise environments at serious risk. Important Vulnerabilities CVE-2025-15467, a high-severity stack buffer overflow in the parsing of CMS AuthEnvelopedData, is the most alarming vulnerability. When OpenSSL uses AEAD ciphers, like AES-GCM, to parse CMS structures, this vulnerability arises.

The Initialization Vector (IV) length's compatibility with the fixed-size stack buffer is not adequately checked by the library.

By crafting a CMS message with an oversized IV, an attacker can take advantage of this. No valid key material is required to cause the crash or possible code execution because the overflow occurs prior to any authentication or tag verification. OpenSSL versions 3.0 through 3.6 are impacted.CVE-2025-11187, a moderate-severity vulnerability involving incorrect validation of PBMAC1 parameters in PKCS#12 files, is the second significant problem.

The PBKDF2 salt and key length parameters are used by the library without validation when checking a PKCS#12 file. A fixed stack buffer is overflowed if the key length is greater than 64 bytes. This can result in a crash or even code execution, but it also requires the user to process a malicious PKCS#12 file.

Versions Affected by CVE ID Severity Vulnerability Type CVE-2025-15467 High Stack Buffer Overflow (CMS Parsing) 3.0, 3.3, 3.4, 3.5, 3.6 CVE-2025-11187 PKCS#12 PBMAC1 Moderate Improper Validation 3.4, 3.5, 3.6 CVE-2025-15469 CVE-2025-66199 Low Data Truncation (openssl dgst) 3.5, 3.6 Low Heap Out-of-Bounds Write (BIO) 1.0.2–3.6 CVE-2025-68160 Low Excessive Memory Allocation (TLS 1.3) 3.3, 3.4, 3.5, 3.6 Additionally, a number of minor problems were resolved. A TLS 1.3 vulnerability known as CVE-2025-66199 permits compressed certificates to cause excessive memory allocation (up to 22 MiB per connection), resulting in resource exhaustion. Furthermore, the openssl dgst command-line tool is impacted by CVE-2025-15469, which causes silent truncation when one-shot signing algorithms are used on files larger than 16MB, leaving trailing data unauthenticated.

It is highly recommended that users update their OpenSSL installations right away.

According to openssl-library, the vulnerable code paths (like the CMS and PKCS#12 implementations) frequently lie outside the FIPS boundary, so most of these problems typically have no effect on the FIPS modules. Suggested Improvements OpenSSL 3.6 → Update to 3.6.1 OpenSSL 3.5 → Update to 3.5.5 OpenSSL 3.4 → Update to 3.4.4 OpenSSL 3.3 → Update to 3.3.6 OpenSSL 3.0 → Update to 3.0.19